Penetration testing careers 101: Learning and getting certified | Cyber Work Hacks

[00:00:00] Chris Sienko: Today on Cyber Work Hacks, I've invited James Stanger of CompTIA to discuss their PenTest Plus certification. 

[00:00:06] James Stanger: So you're gonna be learning about basically the steps that you take as a pen tester, which is different really than the steps you take as a hacker

[00:00:14] Chris Sienko: Now I know a lot of you are all in on careers in pen testing, blue teaming, red teaming, incident response, and more, and James explains the ins and outs of the PenTest Plus certification, which is part of our PenTest Plus Bootcamp, 

[00:00:26] James Stanger: you understand, uh, network discovery, social engineering, vulnerability analytics, how to do exploitation, spreading from one system to the next. elevating privileges, things like that.

[00:00:37] Chris Sienko: as well as some hands on activities you can do and put onto your resume.

To show employers you really have what it takes to do the big work in pen testing and ethical hacking. 

[00:00:46] James Stanger: best pen testers are the people who spent time as a tech support person, or as a cloud person. I once knew a great pen tester, my goodness, this was, this guy was the prince of darkness. He started as a email administrator for Yahoo back in the day.

[00:00:59] Chris Sienko: That's all on today's episode of cyber work hacks. 

The IT and cybersecurity job market is thriving. The Bureau of Labor Statistics predicts 377, 500 new IT jobs annually. You need skill and hustle to obtain these jobs, of course, but the good news is that cybersecurity professionals can look forward to extremely competitive salaries. That's why InfoSec has leveraged 20 years of industry experience Drawing from multiple sources to give you, cyber work listeners, an analysis of the most popular and top paying industry certifications.

You can use it to navigate your way to a good paying cyber security career. 

So to get your free copy of our cyber security salary guide ebook, just click the link in the description below. It's right there near the top, just below me. You can't miss it. click the link in the description and download our free cyber security salary guide ebook.

Your cyber security journey starts here. 

Now let's get the show started 

 

[00:01:55] Chris Sienko: hello and welcome to a new episode of cyber work hacks. The purpose of the spinoff of our popular cyborg podcast is to take a single fundamental question and give you a quick, clear, and actionable solution and a new insight into how to utilize InfoSec products and training to achieve your work and your career goals.

So, uh, my guest today is James Stanger from CompTIA. That's the computing technology industry association. Now, James has joined me on several past episodes. Several hacks, a couple of main feed episodes. We talked about data plus, we talked about cloud plus, we've talked about the security trifecta. We've talked about, um, CYSA plus we've, we've, we've run the gamut here.

So, uh, uh, today I wanted to talk, uh, about the concept of pen testing. We talked recently with Infosec's bootcamp instructor, Akeel Phillips for the certified ethical hacking and pen test plus dual cert bootcamp. Um, and now Akeel had talked about CH a bit, and I want James to come in and talk primarily about how the pen test plus cert works and how it can be leveraged into your first pen testing career.

So, uh, James, thanks very much for joining me today.

[00:02:56] James Stanger: Anytime, man, anytime. It's always fun talking about pen testing and things like that.

[00:03:01] Chris Sienko: Absolutely. And that's, uh, that's what our, our listeners have told us abundantly that that's what they want to hear about. So, uh, so I hope y'all are, are, are leaning in close for this one. So James, let's, let's start with the sort of parameters of the pen test plus certification. What are the areas of study that you're going to deal with in this exam and this certification?

And what type of work with the certification prepare you for?

[00:03:22] James Stanger: So you're gonna be learning about basically the steps that you take as a pen tester, which is different really than the steps you take as a hacker. Because as a

[00:03:31] Chris Sienko: Yes,

[00:03:32] James Stanger: you're gonna do things like planning and scoping the attack, which includes a contract, and that's one of the, uh, I guess it's not really a joke, but uh, you know, what's the difference between a pen tester and a hacker?

And the answer is, Jail time.

[00:03:44] Chris Sienko: yeah,

[00:03:45] James Stanger: But the

[00:03:46] Chris Sienko: for sure.

[00:03:47] James Stanger: Do you have

[00:03:48] Chris Sienko: Hmm.

[00:03:48] James Stanger: at work that says, you know, and it's kind of a get out of jail free card

[00:03:52] Chris Sienko: Yeah.

[00:03:53] James Stanger: it's part of the planning and scoping. I've done pen testing and I, we sat down and wrote out the contract and, and I had a copy of the contract with me as I went in and did physical pen testing, because if I blew it, because I went in, I would sneak in at night.

[00:04:07] Chris Sienko: Mm hmm. Right, right.

[00:04:08] James Stanger: it, I'd get arrested. And at least I had, you know, can you call this number? And then hopefully I wouldn't spend the night in jail. Uh, and I'd get out and it was like, okay, I see it. So planning and testing. Then you understand the hacker lifecycle from the attacker's perspective,

[00:04:22] Chris Sienko: Mm hmm. Yeah,

[00:04:25] James Stanger: Um, you understand, uh, network discovery, social engineering, vulnerability analytics, how to do exploitation, spreading from one system to the next. elevating privileges, things like that.

[00:04:38] Chris Sienko: that's a that's all stuff that I think is very exciting. So I want to talk about some of the key career paths that they can branch off from the solid foundation that you can find with a pen test plus because all the all the search we talked about so far. There's always the sort of. The role that you think you're, you're aiming to get with that specific cert, you know, uh, CYSA plus, I'm going to be a sock analyst, but there's other things that you can use that with pentest plus.

I imagine there's a similar thing here. So are there any other maybe related career paths or specialties that would also benefit from someone who's pentest plus certified?

[00:05:10] James Stanger: There's so many adjacent job roles with that. So if there

[00:05:13] Chris Sienko: Okay.

[00:05:14] James Stanger: who I know who have gone from pen testing into a GRC, risk management

[00:05:18] Chris Sienko: Hmm.

[00:05:19] James Stanger: perspective, um, uh, uh, that some people would say, well, wait a minute, pen testing is very technical and GRC is less technical. It's like, actually, you know, technical becomes a pregnant word as it were.

And so

[00:05:32] Chris Sienko: Yeah.

[00:05:33] James Stanger: over into that job role very nicely. You can become a threat hunter, which is kind of a combination

[00:05:38] Chris Sienko: Yeah.

[00:05:39] James Stanger: Pen testing and blue teaming. People call it purple teaming. But the idea of understanding how can I really understand the threat attack surface of a of the bank I work for or

[00:05:52] Chris Sienko: Hmm.

[00:05:52] James Stanger: care company I work for the manufacturer, things like that. Uh, other things you can become a vulnerability manager. Vulnerability analyst, as it were, somebody who instead of doing actual pen testing, right, that will be a part of it, but you'll kind of understand the entire, what it means to update systems in a systematic way

[00:06:13] Chris Sienko: Yep.

[00:06:14] James Stanger: manage various vulnerabilities.

That's that's a significant thing. Um, it is not trivial to update systems.

[00:06:20] Chris Sienko: yeah. And that's, that also sort of leans in with, with GRC, I imagine as well, because you're anything that's not, you know, any vulnerabilities that aren't patched, you're, you're taking a calculated risk, whether, you know, it's because you don't have the money or time or because you think that your money, your time is better spent elsewhere, right?

[00:06:35] James Stanger: that's right. And you know, it's interesting that the job roles having to do with risk management, you know, their entire job roles about, uh, you know, for example, um, ISACA does a fantastic job. Of going into it's CISM, CISA, a type of, uh, uh, uh, Uh, risk management kind of job roles. You see pen testers going into that area, that's much more buttoned down as

[00:06:58] Chris Sienko: Yeah.

[00:06:59] James Stanger: suppose, but there's nothing wrong with that to it.

[00:07:01] Chris Sienko: Yeah.

[00:07:02] James Stanger: can, uh, lead you to a lot of different places in the same way that a good pen tester can pivot. And, uh, in other words, make choices. Okay. Okay. I've, I've gotten my initial access. Now, where do I go? You know, uh, I've got in on Kerberos or I got in on an Active Directory hack. where can I go?

What next system? It's kind of the same way with your career in pen testing.

[00:07:23] Chris Sienko: Fascinating. Yeah. I love that.

[00:07:25] James Stanger: ways.

[00:07:25] Chris Sienko: Love that. Uh, so, uh, you know, the most common comment we hear on cyber work is from people who are just trying to get started in cyber security, and a lot of them kind of get overwhelmed by the number of possible, uh, directions that you could take in your study and your career, and, and there's a lot of, well, what if I, what if I choose the wrong one?

What if I learn something that it's not useful, and then I've, you know, wasted a year of my life or whatever. Can we break down a few of the first steps that people who are interested in things like pen testing, ethical hacking, and related careers, Should consider when mapping out their their early careers and study plans Yeah,

[00:08:00] James Stanger: unless you understand the mechanism of pen testing. And I don't mean the application that, that makes, that makes you what they used to call anyway, a script kitty.

[00:08:08] Chris Sienko: yeah,

[00:08:09] James Stanger: you need to understand those foundations, DNS.

[00:08:12] Chris Sienko: yep

[00:08:12] James Stanger: need to understand, so you have to have that well in hand. 

best pen testers are the people who spent time as a tech support person, or as a cloud person. I once knew a great pen tester, my goodness, this was, this guy was the prince of darkness. 

Uh, uh, 

he started as a email administrator for Yahoo back in the day. 

Remember when Yahoo existed, uh, he was a head of email and he, you know, and the pen testing bug, specifically physical pen testing. But he had to start by, uh, knowing, you know, what are the various areas of an attack surface from people to physical, uh, stuff, uh, to the logical, to operational technology, things like that. Does that

[00:08:54] Chris Sienko: Yeah, yeah, no, absolutely. No, that that's, I think that's, that's exactly what I was, what I was looking for in, in, in regards to this. So, uh, you know, talking about pen testing and, and the sort of like, you're really getting into kind of the guts of the machine when you're, when you're doing this, all cybersecurity roles have some

[00:09:10] James Stanger: Sure.

[00:09:11] Chris Sienko: on component of some sort, but, but more than most pen testing is a job that really requires you to have practical hands on experience.

[00:09:16] James Stanger: Big

[00:09:17] Chris Sienko: when you're looking for a job, but you know, the tools, the techniques, the strategies, like you said, not just being a script kiddie and pushing a button and making the tool go off, but like, what are some tips or resources you can suggest for students who want to use the pen test plus for baseline knowledge, but would need a practical space where they could get their hands like dirty and try out tactics in a low risk environment.

[00:09:34] James Stanger: certainly through CertMaster Learn, we have tons of labs that will teach you very specific things about,

[00:09:39] Chris Sienko: Mm hmm.

[00:09:40] James Stanger: uh, uh, working with, uh, uh, my, uh, kind of a sequel injection attack or,

[00:09:46] Chris Sienko: Mm hmm. Yeah.

[00:09:50] James Stanger: discover? Hey, can I get past? Uh, the, the code as it were, uh, the obvious code and get in there and start doing arbitrary execution of code.

So understand the essentials. It's very hands on understanding how databases work. Do you understand how to, you know what, if a database is a series of tables, do you understand how to do those selects? Do you understand SQL? Um,

[00:10:12] Chris Sienko: Right. Right.

[00:10:12] James Stanger: are essential technologies that you want to know and so hands on to me create a play space

[00:10:18] Chris Sienko: Yeah.

[00:10:19] James Stanger: master learn that it creates that for you.

If you don't have that that's fine. have I use VirtualBox And I download a lot of Linux systems and

[00:10:28] Chris Sienko: Yeah.

[00:10:28] James Stanger: and everything and I just start playing and

[00:10:31] Chris Sienko: Yeah.

[00:10:31] James Stanger: rocks at servers And I see if I can Break them and get in.

[00:10:34] Chris Sienko: Yeah, yeah, absolutely.

[00:10:36] James Stanger: all my own stuff,

[00:10:37] Chris Sienko: Yeah, yeah, on your own time. Yeah. No,

[00:10:41] James Stanger: would be bad.

[00:10:42] Chris Sienko: absolutely. Yeah. Throw, throw, throw, throw rocks at your own windows.

[00:10:46] James Stanger: That's right. That's right. and I like that. Yeah, because I have some Windows systems that I throw rocks at.

[00:10:52] Chris Sienko: Oh, perfect. All right. There we go. I, I doubled up on that. Didn't even know it.

[00:10:55] James Stanger: There you

[00:10:56] Chris Sienko: All right. So, uh, as we wrap up today, James, uh, do you have any tips or advice for listeners who might be studying for the pen test plus exam? Like what, what, what sort of study tips do you have to kind of make sure you're ready to go when the test comes?

[00:11:08] James Stanger: of all, I would spend a lot of time looking at those objectives. Make sure that you understand them. And can you do something practical with each of those objectives?

[00:11:16] Chris Sienko: Yes Hmm

[00:11:20] James Stanger: ask around, you know, through LinkedIn or people you know or whatever. Talk with pen testers and ask them specific questions. That will help you a lot too.

[00:11:29] Chris Sienko: Love it. All right. Well James Stanger. This has been so much fun. Thanks so much for your insights. I appreciate it And as always thank you for watching this with this episode of cyborg hacks If you enjoyed the video and felt that it helped you Tell someone about it whether it's a friend or a colleague your social media connections anyone you like We really appreciate the word of mouth and it really does help us grow the the network here And if you haven't please subscribe Uh, you can subscribe to our podcast feed and our YouTube page.

Just go to type in cyber work InfoSec at either of them. It, it does come up pretty easily, or you can go to InfoSec institute.com/podcast to see the full list, uh, whatever you like. And, uh, sign up for notifications or auto download so you don't miss anything because cyber work is now coming out every other Thursday.

Cyber work Hack specifically with these bite-sized answers to your questions. Uh, lots more with James Stanger. Lots more to come. Uh, until next time, uh, keep learning, keep developing your skills and as always, have fun. Bye, everybody.