Software Security Certs

[weijie.lin]

Any recommended certs to get into the software security field ?

did some searches , but it doesnt look like i am on the right track
CSSLP - seems like a life cycle thing and not so much on the technical side ?
SANS software security training - seems like most of the big security certs are ISC2,CCNA,COMPTIA , i might be misinformed though..


My background is .. i've been programming my whole life
and it seems like security is where its at nowadays , not really a fan of network
security , mainly cos all my network stuff return to teacher long ago
so i thought why not software+security

Anyone have any advise for going down this path?

 

[Lastexile]

If you are looking for jobs that deal with software security, there are only a few options - Software/Application Security Engineer, Penetration Tester and Security Researcher.

As a software security engineer, you should be building/integrating tools into the SDLC processes to test and minimize security bugs from hitting production. You may have to perform source code review to look for codes that could be vulnerable as well.

As a Penetration Tester, you typically test everything (software/network/system etc) for security flaws and perform source code reviews etc. At the end of the day, communicate the impact of the vulnerabilities to the stakeholders.

For Security Researcher, this is typically where insane technical people want to be. You perform in depth review of software through source codes or binary auditing (reverse engineering). Definitely require in depth knowledge in computer architecture, how function calls are done in memory and Operating System internals.

Depending on which job you are looking for, you can go for courses that give more emphasis on defense or offense. Either way go for courses & certifications that give you opportunities to learn about common vulnerabilities and exploits on web/mobile/typical thick client applications. My suggestion is, if you can afford, go for one defense course and one offense course to understand both sides of the coin.

Also I don't think you can run away from network since no one really writes standalone software anymore. Everything is interconnected therefore you would definitely need some networking knowledge especially in scenario when you need you write fuzzing tools to automate the testing process for application with network capability.

I think SANS courses are great but they are very expensive. Also I don't think SANS (GIAC) certifications are a big deal since they are really easy to pass once you attended their courses. I am not a big fan of ISC2 certs for technical stuff, I think they are useful for processes and policies development stuff and thats about it.

https://www.sans.org/course/defending-mobile-applications-security-essentials
https://www.sans.org/course/secure-coding-c-plus-plus
https://www.sans.org/course/secure-coding-net-developing-defensible-applications
https://www.sans.org/course/secure-coding-java-jee-developing-defensible-applications
https://www.sans.org/course/mobile-device-security-ethical-hacking
https://www.sans.org/course/web-app-penetration-testing-ethical-hacking
https://www.sans.org/course/network-penetration-testing-ethical-hacking
https://www.sans.org/course/advanced-penetration-testing-exploits-ethical-hacking
https://www.offensive-security.com/...cp-offensive-security-certified-professional/
https://www.offensive-security.com/...ons/osce-offensive-security-certified-expert/

 

[twinbaby]

While these certification.
What most important is the training you have receive and what you learn.

You may have CSSLP, but certs are certs.
I rather go for a 5 days course which teach you after every lecture session the different type of testing : black box, white box, grey box, security testing, static code analysis rathers than just show off to people I have these and that certificate.