In this video, we're talking about getting certified options, pitfalls and more.
Now this is this is version four.
I've gone through and I've redone this a few times.
And if you're coming back, this is most likely a updated version.
And I've taken the two video sets that were about certification I combined into one along with a few
updates.
So let's get started.
So should you get certified and if so, which one?
Well, there's a lot of different certifications out there.
There's Sands has all sorts of certifications.
There's all sorts of network security certifications, penetrations, uh, certifications.
Uh, there's a few there's more and more oaths and certifications coming out, which is really fantastic
to see, because when I first started doing Osint, I, I can't remember seeing a single certification
till a little bit later coming out.
know.
And now there's a lot of different options out there.
But again, it's great to see more certifications for open source intelligence and also ethical hacking
out there now.
So for me I have a lot of different certifications.
Certificate of completion.
We'll get into that.
Diplomas and whatnot I'm not going to get into all of it.
There's there's actually a Google spreadsheet.
This is uh, some of the ones I have.
And in short, I have three engineering certifications, certified hacker information security and way
too many certificates of completion and so forth.
And if you really want to check it out, there's again, there's a Google doc out there that that I
made public.
And you can take a look at it.
So this video is for um for me to kind of get out there and, uh, try to try to prevent you from making
the same mistakes I made.
So when it comes to certifications, certificates and whatnot, again, there's a lot of them out there.
And you can see from the clip of that spreadsheet that, you know, there's a lot there is a lot.
I've taken a lot.
And, um, if I had to do it over again, I definitely would have done it differently and that would
have saved me a lot of time, saved me a lot of money and potentially maybe a lot more money.
And we'll get into that again.
So.
Do you certify or don't you certify or do you just do certificates of completion of anything.
So the real question I would say is what are your goals.
Is it personal growth?
Is it a work requirement?
Are you trying to make yourself more desirable to employers?
Um, that includes people hiring you for contract work.
Is it to improve your personal position at work?
Do you have?
Do you have a certification that you need CPE credit for?
So you really need to know why you're getting into this.
So the important thing is there's two different types.
There's certificates certifications and certificates of completion.
So a certification is normally going to require you to take a test.
You can get CPE credits from this.
You're generally awarded a certain title.
Uh they're generally more sought after by employers.
And they can be very expensive.
Uh, I'm talking some of these could cost thousands of dollars to take a certification test.
And, um, not all certifications are paid.
There are free ones out there.
And that's something I did want to bring up, that if you're if you're working with a vendor, uh,
say, if you're have a bunch of wireless networks out there and there and you're using ruckus, or you're
using, uh, um, Aruba or any of the other big vendors out there.
You may be able to talk to the vendor, and if they have a certification, you may be able to get that
certification test for free.
And, uh, other places will have certain certification things out there that you can do for free.
You just kind of want to go out there and look.
But you do want to make the distinction of is it a certification or is it a certificate of completion?
Now, in this case, for example, I have a this is my one of my engineering certifications accredited
configuration engineer.
So Ace this is for the Palo Alto firewall for example.
And that was not a very cheap one.
Fortunately I didn't have to pay for it.
So that's the other thing.
You may potentially be able to get your employer to pay for these certifications.
In this case, I was able to get my employer to to pay for the training and the certification test,
which was great because again, this was very expensive.
Um, on the flip side, there are certificate of completion, things like you get from Udemy, for example.
Uh, so this normally doesn't require a test.
Some of these do have tests, but the majority don't.
Not just for Udemy but for other places you can get CPE credit.
A lot of time for taking these things.
They may be useful to show an employer, show them that hey, look, you know, I, I took this course
and depending on your employer, you may get some sort of personal growth out of it, meaning that you
get additional money for taking a number of these courses that relate to your job.
And these can be absolutely wonderful for for your personal learning, and it can potentially make you
more valuable to employers when they look at it.
But again, this is not the same as a certification.
And employers may not look at it the same because certificate completion I can sit in front of a computer
and I could take this, this course and whatnot, and I can get a certificate of completion generally.
And in some cases, I don't even have to pay attention.
I can just leave the video running, for example, and eventually it will spit out a certificate of
completion in some cases, whereas a certification, a lot of times you will have to go into some sort
of testing room.
It's proctored or in some cases now you could do it at home.
However, there are a lot of stipulations.
Make sure that you are not cheating.
So again, two very different avenues um, certifications and certificate completion.
Now, one thing I do want to point out and this really gets me upset when I see this.
There are places out there that will advertise certification, and I seen it on Udemy too, where a
couple a couple courses say are certified, you know, hacker certified or whatever, and you get through
it and you don't get a certification, you get a certificate of completion.
Again, very different.
So in this example and this was very recent, um, this particular site said they offer online certification
programs, become an expert in top technologies and are extensive online certification programs.
So they mentioned certification a couple times.
And you look through there.
There's business analytics certification, Python programming certification ethical hacking certification.
And when you actually go there to buy it, you know, again, ethical hacking certification.
Become an ethical hacker and prove your network skills with exceptional training.
And you know, you can see it's deeply discounted from $139 to $54.
And you can see if this certification if you want to give this to someone.
And if you purchase it on the dashboard it says certifications and roles certifications.
So this really sounds like a certification course.
Well talking with them, it absolutely isn't.
You will receive an individual course certificate after completing each course.
You will need to take one of the final assessments which will be awarded the final certificate.
So I did go back and I did talk to them more and said, hey, so this is a certificate, not a not a
certification.
Correct.
And they said yes, as a certificate.
You you end up with a certificate, not a certification.
And I did point out to them, hey, look, this is very deceptive practice that you're doing here.
You're saying this is a certification course, you get a certification.
And what you're giving people is a certificate.
And matter of fact, when you look at the thing, it says a certificate, not a certification.
And unfortunately, the response was a complete silence.
They didn't bother saying anything.
So things like that you want to be very careful of and you want to avoid.
So other things you want to look for is do you want to see is it affordable, what's available in it?
Is there some sort of level of reputation qualification and, uh, preferably a lot of these.
Uh, it'd be great if it has some sort of training in with the certification.
If you decide to go the certification route.
And by the way, I personally don't recommend taking the Ma Olsen certification.
Um, I'll we'll get to that in a minute.
So places like the Mohs Institute, they offer a certification course where you get all these different
levels of of the thing.
So.
Uh, to use as an example, it was reasonably expensive at $450.
Now, I say reasonably, because that may be a lot of money to certain people, and that's not to shame
anyone.
$450 is not a particularly insignificant amount.
However, in terms of certification, that could be really cheap, especially when you're talking things
about AC Council that, uh, The ethical hacking certification was around $3 $3,000 for the course and
the certification test.
Sands will generally run you between one to, I would say, $3,000 or so for a certification.
So again, for 50, reasonably inexpensive from the grand scope of things.
It has a practical certification.
There were some new articles and in a positive light about it, and at least when I was looking for
it and some reviewers had were pretty positive on it.
Excuse me.
Now, the problem is, when I took it, there were several outdated or broken tools.
Some of the exercises had really confusing goals that they actually had to go back and keep tweaking
the the certification as I started bringing up these issues, and it could take weeks to get a single
one of these exercises graded.
The lack of help was horrible.
Generally, if they said if you need help, well go in.
The forms problem was the forms were dead.
Um.
I got stuck in endless resubmission loops or as broken progress tracking.
It was just a bad experience in my.
In my example.
Now.
I also took a look at hackers.
Arise.
Um, open source intelligence certification.
Now this was 3.99 and it comes with a training.
Now I previously took the CWA through their you know that's a certified white hat associate, uh, basically
a white hat hacking, uh, certification.
And that one was okay.
It was all right.
Um, it wasn't great.
I would say, but I took it because when I used to be in the null byte forums, um, this one was kind
of in the works, and there wasn't really a your options were pretty much the same, which again was
$3,000 and you have to go and recertify every few years.
And that was way too expensive for me at the time.
And this started coming around.
So I took that, got certified again, reasonable price certification temp came with a bundle.
You can download the videos and it had some good basics.
So my issue with it was no mention of using a VM.
And I find that incredibly dangerous to an open source intelligence, especially seeing how the person
that runs this is supposedly worked for the NSA.
Um, in some capacity.
No mention of sock puppets.
Uh, that feels completely irresponsible.
Uh, single person runs the entire operation.
It was very difficult to get Ahold of anyone.
Training videos required you to have a paid Dropbox account to get to the videos.
The tests didn't match the training level, and the final test was you had to unmask a real person,
which felt completely wrong.
Basically, you're doxing someone that, uh, they weren't doing anything wrong.
This person was actually going exposing, uh, scammers, which I'm I'm all for.
And the goal was to unmask who that real person was.
And that seems like a very unethical goal for especially for open source intelligence, um, certification.
Uh, so the expectation versus presentation training was disproportionate and again, feels potentially
dangerous because no mention of a of a VPN.
No mention of using a sock puppet.
Yet you're supposed to unmask someone.
Um.
Someone's identity.
So it really felt like you're set up to fail.
So with that information.
Now what?
Well, again, there's more and more options coming out for especially if you want to take open source
intelligence or ethical hacking.
Now Intel Techniques has the OCP and that's by Michael Bazzell, a really incredible open source intelligence
individual.
I don't know him personally.
I just know him by reputation.
Again, there's more cybersecurity, which I don't recommend.
McAfee Institute, which I did take and I, I did like it a lot.
And a new one to me is OSC, which is open source certified.
And this is developed by Osint professionals.
And this one I even though I'm certified through McAfee Institute, I.
I am tempted to take a look at the OSC also.
So things to look out for.
Certifications are recognized by organizations that you want to work for or potentially work for.
Certifications that are all inclusive or affordable.
Bundle is a good thing to look for.
Certifications are willing to answer your questions before you buy.
So especially if you're dealing with a expensive certification, you want to be able to ask them all
the questions that you want before you take the dive and spend a whole lot of money and a whole lot
of your time.
After all, this is your time and money.
It is valuable.
So if you have questions, you have every right to ask that organization or that person those questions
before you buy the course.
Now is, of course endorsed and recommended or vetted by anyone.
How often are they updated?
Is, um, does your content, uh, is it is it content updated even after you buy?
Um, how long have they been around?
Do they offer practice tests?
How long is certification good for?
Do you have to renew it?
Is it actually certification or just a certificate?
Is a certification issued with a unique id id to verify that?
Yes.
In fact, you did take the certification in.
A potential employer could take a look and pull up those records.
So.
In the case of Mac and me, we took it.
Uh, it had things like live instructor support, money back guarantee, and it had a list of different
organizations and people that did recognize the certification and things like Missouri Police Department,
US Department of Veteran Affairs.
ET cetera, et cetera.
So that was that was, you know, important to me.
And in this case, they had information about their team, about the company, a refund, policies,
terms of service, renewing your certification, codes of conduct.
It had a telephone number.
It had email address.
It was easy to find and easy for me to get Ahold of someone.
Again, very important to me.
And they had an FAQ, which was very clear and helped a lot.
And these are all great examples of what you want to see in a potential certification.
So again, communication is absolutely critical.
Sites should be easy to get Ahold of, and you should be free to ask any questions before you buy it
during and even after.
Of course should be up to date.
and again accredited certified endorse all of that's very important.
So it's important to see who's endorsing who recognizes it.
And again it's your time and money that you're spending on this.
So in the end I did get certified.
And um, I was able to pass it the first time.
Um, the in this case, when I took the consent course, I liked it a lot.
The courseware was pretty good.
The practice had a lot of practice tests after each session, which was fantastic.
That helped a lot.
And the actual test was I thought it was a good test.
And they also gave me a, um, book I can download.
And um, they did update it.
So when I took it, it was definitely older than this and it just looked back and they updated it fairly
recently.
so that's great to see that they did update it.
I still had access to the updated material.
And again, having online quizzes is really, really useful in your certification that you're looking
at.
Should have some sort of quiz or test that you could take to practice before you take the plunge and
take the take the test.
Now, in this case, it was I was able to take the test at home.
It was a proctored exam, so no photos, notes, pens or other electronics in the room.
I can only have one monitor.
I had to scan the room with my with my phone.
I actually had a live person on the other end and they they took a look at the room.
No food or drinks around.
I had to have a webcam pointed at me, and I had to move my desk to point to the door.
That way they can make sure that no one was at the door, kind of giving me answers again, it scanned
the entire room, top of my desk, under my desk, and it was a live person the entire time watching
me take the test.
A lot of other times you actually go into a testing center.
They put you in an individual room and you take your test.
So final consideration is getting your certification.
Certification can be incredibly rewarding.
Same thing with with your certificate.
Depending on again, what your goals and what your needs are.
It's a great way to show people and employers your ability and credibility.
It's a way to evaluate why you want to get.
You need to evaluate why you want to get a certification, rather, determine which certification or
certificate suits your need, and consider which certification or certificate will be recognized by
your current or potential jobs or clients.
And a final note.
And I've had people tell me this a couple of times and it drives me nuts.
So either they took a certification or they're thinking about taking a certification and then they check
something like Reddit, or they check, uh, X or some forum or whatnot, and people are talking all
sorts of junk about it.
Your certifications worthless.
Anyone with half a brain could, could, could have passed that.
Uh, you don't need to study for that certification.
Um, that's completely worthless.
That's, you know, you wasted your time.
It's not worth the paper it's printed on, uh, etc., etc..
So.
My answer to people like that are, um, no, you didn't waste your time.
So if you got value added certification or certificate, if your employer finds a value in that certificate
or certification, you did not waste your time.
You took your time, your money, and you studied and you applied that knowledge to take that test.
That means something now.
In my experience, people that usually talk all sorts of junk about a certification have never taken
that certification.
Or they took it and they failed that certification.
If they cannot give you a valid, detailed reason why that certification is garbage, then they are.
Well, I'm just going to say full of crap.
Okay.
Um, again, it's even certifications that I do not particularly agree with that I don't that I don't
agree with some of the questions they ask.
That is still time and your knowledge that you are proving that you are, that you are a expert in that
subject matter.
So that does account for things, and you should not let people tear you down for your goals and for
your accomplishments, because at the end of the day, you spent that time, you spent your energy,
you applied your knowledge and your ability to pass that whether it's a test that you take or it's it
is something that you actually have to go in and you have to do something live like, um, break into
a network that's, that is designed for you to break into or gather this information.
Again, that is your time and your knowledge and your skills that accomplish that, that, not them.
They didn't do it.
You did.
So don't let people tear you down for it.
So that's a lot to think over.
Hopefully, um, this kind of sets things straight and kind of sets things at ease for you.
Thank you so much for watching.
I'll see you in the next video.