Chapter 4: Exploring Certifications and College

Skillsets often apply directly to a few different things. One of those is skillsets that you gain from on-the-job training, or mainly being in the field and gaining experience while you're in the thick of it. However, that doesn't always get to be the case for everyone, especially someone outside of cybersecurity trying to get into cybersecurity. Individuals looking to get into cybersecurity often look to college degrees and certifications to help build their skillsets and help them stand out among other aspiring (or even current) cybersecurity professionals.

This chapter is going to cover various certifications that aspiring cybersecurity professionals can achieve to help them get the job they are looking for. Additionally, these certifications are great for road mapping a plan to a particular career that an individual may want to pursue.

In this chapter, we're going to cover the following main topics:

• General...

General security certifications

The title may be a little off-putting; however, general security certifications entail undergoing training and proving that a certified person understands a broad range of topics as they relate to cybersecurity. This by no means illustrates that the certified person is a subject matter expert; rather, they have become a master of none but knowledgeable of their craft.

Important note

As you move through your career, don't expect to master every subject. Technology and cybersecurity move so quickly that it is virtually impossible to master a subject. However, this does not mean that you will not be regarded as a subject matter expert or someone who is highly knowledgeable within your focused domain.

When starting out in information technology or cybersecurity, it is highly recommended that you look to general certifications to help guide you on your path to your dream career. That being said, you may be thinking, "Why would you go...

Hacking the planet – diving into the big red certifications

Red certifications are something that has become quite popular in recent years. Red certifications essentially involve any certification that revolves around offensive security, which can include terms such as the following:

• Pentesting
• Red teaming
• Exploit development
• Application security
• Purple teaming (yes, even a different color!)

What do these mean, and why is it essential that you understand what certifications are right for you? That question can be answered by illustrating the issues that can come from taking on too many certifications – yes, this is a thing!

Offensive security certifications, by design, either teach you the fundamentals of offensive tactics or can elaborate and go extremely advanced and require you to take hands-on exams that can last days or even weeks on occasion! That's why it's best to understand what type of certifications best fit the...

Alert! Checking out blue teaming certifications

Before we dive into the certifications, let's quickly mention what blue teaming is. As mentioned in the previous section, red teaming is comprised of individuals who hack systems to illustrate the organizational impact based on vulnerabilities discovered and exploited in the target system. With that in mind, blue teaming can be thought of as the exact opposite.

Blue teaming consists of a team, and a department, of professionals who monitor the security of the systems they work for. This means consistently looking for alerts and determining alerts as incidents, false positives, or false negatives.

Sometimes you may hear these words and phrases used with blue teaming:

• Incident response
• Computer Incident Response Team (CIRT)
• Operation la Operations (SOC)
• Threat hunting

One of the interesting hot topics coming up with blue teaming is threat hunting. Threat hunting consists of a company employed to go...

Checking the box – auditing certifications

This section, and the one following it, will be smaller than the ones on other certification paths (within this book and in general). However, that should not make you think that there is less significance in auditing within cybersecurity. Auditing is a process that ensures that companies are maintaining the minimum technical, operational, administrative, and ethical levels needed to operate a business or corporation. Commonly known as checking the box, auditing is a process that typically requires a specialist or analyst to analyze and evaluate a company against a predetermined checklist.

Let's take a good look at what is one of the most popular certifications within the auditing arena.

Certified Information Systems Auditor (CISA)

The Certified Information Systems Auditor (CISA) is an industry-standard certification for becoming a top-caliber security auditor. The CISA is provided by ISACA, a global association with an...

GRC/management certifications

GRC stands for governance, risk management, and compliance – a practice where professionals focus on what is needed to ensure that compliance and risk management are executed successfully. In addition to GRC, management plays a key role in ensuring that risk is mitigated correctly and effectively. Those looking to have a career in management or GRC must understand that this is one of the fewer hands-on careers in cybersecurity and focuses more on strategy and compliance.

While many general cybersecurity degrees focus on compliance and high-level cybersecurity, such as governing and managing risk, it is important to note that there are certifications out there that help with this as well. The next three certifications on our list of certifications will help you with your career in GRC and cybersecurity management.

CompTIA Project+

The CompTIA Project+ certification is a certification that will help those looking to understand how to make...

College of knowledge – discovering the benefits of a cyber degree

One of the most controversial things you will ever hear about cybersecurity is whether you should or should not get a degree in some type of technology-related program. You may be asking yourself, Should I get a degree or should I pursue certifications if I already have a non-technical degree? A lot of the discussion revolves around the statement "You do not have to have a degree to be in cybersecurity," which is 100% true, but also not 100% true. What we are really trying to say is that studies show that degrees may not be the guarantee to get you into cybersecurity; however, they do provide you with a better pay scale and job promotions when it comes to timelines. In fact, studies show that entry-level cyber positions typically pay anywhere from 10% to 15% more if you have a degree. On top of that, many jobs in cybersecurity require a higher-level degree such as a master's, or for dedicated research...

Summary

As you can see, there are so many ways to get into cybersecurity and even more different domains on how to get into cybersecurity. You must take the information discussed in this chapter and link it to your own timeline on what certifications you want to get, what type of career you want in cybersecurity, and how you want to apply that knowledge.

To recap this chapter, you should now understand the following:

• The various cybersecurity certifications
• That different degrees build different skillsets
• The importance of building home labs
• The importance of networking with others
• Understanding that continuous learning is part of the cybersecurity journey

In the next chapter, we are going to be diving into how you can get hands-on experience without actually having to be on the job.

Further reading

Refer to the following links for more information on the topics covered in this chapter:

• General certs: https://resources.infosecinstitute.com/topic/7-top-security-certifications-you-should-have/
• Cyber operations programs: ters-academic-excellence/cae-co-centers/
• Overview of cybersecurity degrees: https://cybersecuritydegrees.org/