Looking for direction

colinireland

Hello,

I am interested in the field of IT Auditing and penetration testing. I have a degree in physics but I am planning on going back to college to do a postgrad on the IT side of things. Could anybody suggest a few courses around the country to me? Also, are the SANS training courses of much use? What other certifications are worth looking into and what cost?

Thanks,
Colin

NullZer0

Being me, I'll suggest self study and the following certificaions :

CCNA
http://www.cisco.com/web/learning/le3/le2/le0/le9/learning_certification_type_home.html
CCNA Security
http://www.cisco.com/web/learning/le3/le2/le0/le1/learning_certification_type_home.html
CCSP:
http://www.cisco.com/web/learning/le3/le2/le37/le54/learning_certification_type_home.html

Building up to CISSP over a period of a few years:
http://www.isc2.org/

harney

If you can afford it then the SANS GPEN course is quite interesting. It steps you through a structured Pen test from begining to end, going through things you will not necessarily go though on a real pen test. If is advisable to be familiar with linux and some of the tools, such as nmap, tcpdump, wireshark, and netcat before going on one of their courses.

Exam wise, it is open book so I didn't find it particularly difficult but it is possible to fail it.

One of the sites recomended on the course gives an idea of the structure of a network assesment.

http://vulnerabilityassessment.co.uk/Penetration%20Test.html

briano

The CISSP isn't really related to penetration testing at all and only has a pretty broad overview of auditing. Some of the ISACA stuff might be more appropriate, for instance the CISA (http://www.isaca.org/Template.cfm?Section=CISA_Certification&Template=/TaggedPage/TaggedPageDisplay.cfm&TPLID=16&ContentID=43558)