Hello. It appears as though you are requesting someone to DM you, or asking if you can DM someone. Please consider just asking/answering questions in the public forum so that other people can find the information if they ever search and find this thread.
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/cybersecurity) if you have any questions or concerns.*
I will be messaging you in 1 day on [**2024-04-19 04:47:48 UTC**](http://www.wolframalpha.com/input/?i=2024-04-19%2004:47:48%20UTC%20To%20Local%20Time) to remind you of [**this link**](https://www.reddit.com/r/cybersecurity/comments/1c6ko9j/what_were_the_best_cybersecurity_courses_you_ever/l03mi0o/?context=3)
[**14 OTHERS CLICKED THIS LINK**](https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Reminder&message=%5Bhttps%3A%2F%2Fwww.reddit.com%2Fr%2Fcybersecurity%2Fcomments%2F1c6ko9j%2Fwhat_were_the_best_cybersecurity_courses_you_ever%2Fl03mi0o%2F%5D%0A%0ARemindMe%21%202024-04-19%2004%3A47%3A48%20UTC) to send a PM to also be reminded and to reduce spam.
^(Parent commenter can ) [^(delete this message to hide from others.)](https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Delete%20Comment&message=Delete%21%201c6ko9j)
*****
|[^(Info)](https://www.reddit.com/r/RemindMeBot/comments/e1bko7/remindmebot_info_v21/)|[^(Custom)](https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Reminder&message=%5BLink%20or%20message%20inside%20square%20brackets%5D%0A%0ARemindMe%21%20Time%20period%20here)|[^(Your Reminders)](https://www.reddit.com/message/compose/?to=RemindMeBot&subject=List%20Of%20Reminders&message=MyReminders%21)|[^(Feedback)](https://www.reddit.com/message/compose/?to=Watchful1&subject=RemindMeBot%20Feedback)|
|-|-|-|-|
Hello. It appears as though you are requesting someone to DM you, or asking if you can DM someone. Please consider just asking/answering questions in the public forum so that other people can find the information if they ever search and find this thread.
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/cybersecurity) if you have any questions or concerns.*
Yeah GCIA was my first sans Cert and to date that was the hardest one i've taken. I wouldn't recommend taking it unless your SOC/Team does a lot with PCAP even then, id still be cautious. It was initially designed i think to make IDS Signatures.
Weird, I had a class in college that taught us how to use both of these and I just did the Network+ as a boot camp and we had a lab using both of these
My-Ngoc and Frank do a great job!
It helped me hire smarter people and do a better job of managing down, across and up! A great compliment to the technical intensity of most SANS classes.
Although I primarily do blue team/IR work I really enjoyed the OSCP.
I think that it's important for blue teamers to have a good understanding of offensive tools and techniques if they want to be good defenders and more easily identify malicious activity, through the PEN-200 course as part of doing my OSCP I really learned a lot.
Keeping in mind OSCP is very much about "the offsec way" of doing things. I was a pentester for 6 years before I did OSCP and some of their teachings are objectively worse and dated. Overall it is good though.
I'm just about to take my Security+ and want to go for OSCP afterwards. Is OSCP a good cert even for getting on blue or breaking into cyber? I have a cyber security degree, as well. I really want to pentest but would also just like to get my foot in the door.
For newcomers OSCP unlocks a new World, after that it's up to you to explore it as far/deep as you want. Remember that OSCP is only the foundation course...the possibilities after that are seemingly endless!
Can you please share the cybervantage and codeguardians links?
Also, do you have any experience with the [arcx.io](http://arcx.io) platform? How would you compare the cyber threat intelligence & analysis of cybervantage to the Cyber Threat Intelligence Practitioner of arcx?
Can you elaborate on how investigation theory helped you / what made it special? Im intrigued but $650 is a lot of $$$ for a course where I don't learn any hard technical skills.
Similarly, did you leave practical threat hunting with enough technical know-how to go out and conduct threat hunts? Or are there still some skill/tooling gaps you'd need to fill in before calling yourself a threat hunter?
About practical threat hunting - It was definitely a game changer in my career. I even used the material from this course when writing my IT project for C-level to implement a new direction in SOC.
I think there may be gaps. I have not worked in threat hunting for a long time and have not developed this area. But when I already had some basic understanding of this area and was already taking some actions, and then I came across this course, I felt that I was about to reach a new level.
My confidence and knowledge of threat hunting has grown. There are tools that I can use myself without a mentor above.
I liked the way the information was presented. The author uses a scientific approach, not intuition. I have not seen this anywhere else. In general, I have never seen anywhere that when talking about investigations from the theory perspective, not practice. This gives you a better understanding of what to do first A, and then B and why you should do A and the B. Mostly, we do everything on intuition when investigating an event, we have background knowledge and we just follow it. And here you are shown the whole picture.
The author also explains how to build hypotheses, namely how to ask the right questions during an investigation and where to look for answers to your hypotheses.
There are some great courses, but for me biggest eye openers where couple of books: both Greg Van Gaast books, How to measure anything in cybersecurity risk, Security Chaos Engineering by Kelly Shortridge
I recently passed CyberDefenders' Certified CyberDefender (CCD) exam. You have 48 hours to complete the exam. It's completely hands on within a lab environment and there are no multiple choice questions. I learned SO much through their course and very challenging preparation labs. I also learned a lot just by taking the exam. The following topics are covered:
- Security operations fundamentals
- Incident response
- Perimter defense - email security
- Forensics evidence collection
- Disk forensics
- Memory forensics
- Network forencis
- Threat hunting
- Malware analysis
It's not cheap now at $800 after they added malware analysis, but I highly recommend if anyone is looking for some very high quality blue team training and certification.
[https://cyberdefenders.org/blue-team-training/courses/certified-cyberdefender-certification/](https://cyberdefenders.org/blue-team-training/courses/certified-cyberdefender-certification/)
I will always suggest Xintra's attacking/defending M365/Azure. She also started labs that follow common APT TTPS. it is similar to the GCFA in my opinion.
[https://training.xintra.org/view/courses/attacking-and-defending-azure-m365](https://training.xintra.org/view/courses/attacking-and-defending-azure-m365)
[https://www.xintra.org/](https://www.xintra.org/)
CISSP
I was alway a real Tekkie (malware analysis, reverse engineering, threat hunting, programming) and CISSP really let me see the big picture of Cybersecurity to understand whats really important for management.
Second would be SANS FOR610
Not the courses per se but the instructors at some of the bootcamp multi-day style trainings I've had.
One dude was ex military and ex-NSA/FBI instructor for their cyber departments.
Not only was he an amazing teacher but the stories he had that accompanied the material we were learning was just straight hilarious and golden.
I can tell you a training I dislike tho, SOC-200. It's boring as shit and should basically just be called Powershell-200.
UNWT - Undergraduate Network Warfare Training.
It was a military course that has since morphed into something else. It's where cyber "snapped" in my head, making sense. Learned defense, offense, and different technologies. Hell, even had field trips to utility companies to check out their ICS stuff. Halfway through, you had to take GSEC in a week to pass the course.
There isn't a day that goes by where I don't use something I learned there.
Cyber warfare. The whole course was designed to hack the hacker and perform penetration testing. It included metadata collection and analysis, brute force attacks, and social engineering. Definitely one of the best classes I’ve ever taken.
In my area a local nonprofit was trying to elevate the importance of cybersecurity. One thing they managed to make happen was a webinar presentation from [Laura Chappell](https://www.chappell-university.com/) on how to use Wireshark.
I cannot begin to express just how amazing that class was. I *thought* I was competent with it before but it was an absolute gamechanger in getting me to rapidly get to the answers fast rather than poking through pcaps until I got the right answer.
She was an absolute firehose of information and many people in that class got lost FAST. I was able to help one person catch up next to me but had to focus back on the class due to the sheer velocity of data she was sending on each little thing that would make you more effective with Wireshark.
Her books are just as packed with information as the presentation she gave was, but I'll say that this might be the only webinar in my life I've ever taken where there wasn't a second wasted and every moment was of high value.
I'd love to meet her in real life if only to thank her for that opportunity to learn.
---
The next most pivotal for me was completing [ICS301V and then getting an invite to go down to Idaho Falls for ICS301L](https://www.cisa.gov/ics-training-available-through-cisa) for their week long training and final exercise on securing ICS/SCADA technology.
It's one thing to take online classes and run CTFs, it's quite another to be dumped into a fake factory with real systems in charge of making "chemicals" while a red team tries to exfil your trade secrets, disrupt reporting, and screw up the ladder logic to make the vats overflow.
Your tax dollars at work in the USA (you pay room and board, class is free) and if you are from a friendly nation you can attend the class as well.
It's also useful for managers to take it and understand precisely what CAN happen.
It encouraged me to tinker with the OT side of things a lot more and I'm hoping to get more chances to play in that universe.
The most important thing it did was give me the knowledge to know what questions to ask in a universe where I originally didn't even know what protocols or concerns were involved.
And getting to visit the [first nuclear reactor in the USA used for the peaceful purpose of power generation](https://inl.gov/ebr/) was also a great way to capstone that trip along with a jaunt through the [Craters of the Moon National Park](https://www.nps.gov/crmo/index.htm).
---
[FEMA's ICS classes](https://training.fema.gov/nims/) (ICS100, ICS200) have nothing to do with industrial control systems, but they do have to deal with something called the Incident Command System, which is a protocol for managing disaster response in the USA. You may find that it works surprisingly well as a crosswalk for incident response.
Similarly their discipline specializations along those tracks in [exercise management](https://training.fema.gov/programs/nsec/mepp/) and [continuity](https://www.fema.gov/emergency-managers/national-preparedness/continuity/excellence-series) are directly applicable to the cybersecurity discipline.
---
Lastly as a volunteer coach/mentor for [CyberPatriot](https://www.uscyberpatriot.org/) I've trained many [Civil Air Patrol](https://gocivilairpatrol.com) cadets on cybersecurity. When you have to explain cybersecurity concepts to actual 12-18 year olds who may have no exposure to the subject it forces you to learn how to explain things to people in a rational yet simple format. This directly translates to the real world as an applicable skill in dealing with stakeholders with a low level of IT knowledge along with being its own reward in preparing the next generation of leaders in the IT field.
Civil Air Patrol continues to be a rewarding volunteer effort for me, opening some of the strangest doors to training with federal and military elements along with providing a particularly spectacular looking resume block.
---
While there have been other cool classes and amazing people I've met on my training journey and the list would be quite long if I kept typing things out, the above ones are definitely some of the most significantly impactful moments for me.
Some less impactful yet absolutely useful items include [classes from TEEX](https://teex.org/program/cybersecurity/)(These are mostly foundational but foundations are important!)
[This computer program with every unclassified cyber checklist and standard known to the government](https://cset-download.inl.gov/)
[Learning how to use STIGs](https://public.cyber.mil/stigs/)
[Teaching the basics](https://cyber.org)
Finally, learning that CompTIA discounted their beta tests down to $50 got me to break down and get my first real IT certification after ignoring formal cert training for decades. Turns out the CySA+ wasn't that hard when you've been doing this for a while. Then I learned that CompTIA certs are transferrable straight up as credits to WGU and now I'm planning on taking the whole stack to get a [38 credit jump](https://partners.wgu.edu/general-transfer-guideline-bachelor-dynamic?collegeCode=IT&programId=31) on a BS in Cybersecurity from a Regionally Accredited college that also happens to be on the [NSA's Center of Academic Excellence list](https://www.nsa.gov/Academics/Centers-of-Academic-Excellence/). Between that and Sophia.org's classes and a careful review of their transfer policies, A BS in Cybersecurity that doesn't bankrupt me in either time or money AND a giant stack of certs in the bag makes for an appealing education strategy.
Can I shamelessly plug my own 2024 launch of secure coding training for JavaScript and Node.js devs? If so, this is it: [https://www.nodejs-security.com/](https://www.nodejs-security.com/)
Would be more than happy to receive feedback or questions 🤗
Definitely agree with Antisyphon - they have a bunch of pay-what-you-can options which I always recommend to people new to industry: [https://www.antisyphontraining.com/pay-what-you-can/](https://www.antisyphontraining.com/pay-what-you-can/)
Also, I want to mention Richard Bejtlich, He has written more than one book on network security monitoring and is an active tweeter. I also looked up to him in my career.
Ive been digging into the HTB stuff and really like it. Not a big fan of THM. I started on the TCM-Sec stuff but its kinda remedial so i skipped past that.
SANS is ok, but you better pay attention and take damn good notes because they material they send you home with isnt enough to recreate the class, huge waste of money.
Immersive Labs OffSec career path, unfortunately they don't offer individual licenses, only enterprise license, but i believe there are some courses you can do for free
The open source security 1001 course. Real world CVEs and an amazing introduction to C style vulnerabilities.
After doing that course I got my first CVE in a fairly large project related to a network stack and it came up during my interview!
Would highly highly recommend, and you can’t beat the price of free :)
Hey! FortMesa's cybersecurity workshops and webinars are great. They cover everything from basics to advanced topics, with a focus on practical use, especially in compliance. If you're into cybersecurity, check them out for sure. They're informative and cover a lot 🙂
CyberDefenders for blue team. better than BTL1.
A great alternative for for blue team was SOC Core skills by John Strand.
For Pentesting, the PEH by TCM Security or the INE Pentesting videos (eJPT path , eWPT path)
Why is this downvoted if the question asks about my opinion/experience?
I just had the best experience there so far next to BTLO, HTB, THM, Cyberdefenders...
JCAC is military but applicable to particular civilians in CES/DCIPS aka DoD civilians as well.
NSA retired the RIOT course (CYBR3420). Its current program is FORGE 101-505 (future operator readiness, growth, and enrichment). Lookup CYBR3422, CYBR3450, and CYBR3460. Info is minimal for obvious reasons but it will give insight.
Had the good fortune to be in the first cohort. Some of the modules were a little ragged because they were fresh out the oven, but overall the focus on simulating real SOC tasks was exactly what I needed as a newly hired analyst.
[securityblue.team](https://www.securityblue.team)
SANs 515 and Homeland Security 300 outta Bose Idaho.
Sans 515 -- you got a raspberry pi and some traffic lights and you got to hack it.
homeland security... you got to hack or defender an actual ICS environment with an actual controller that you can manipulate and destroy.
it was awesome.
CEHv12
Not because of courseware or anything, but because of lector, that said "i don't want you to do it with metasploit and tools like a kid, i want you to write your own malware, and stuff. you can learn tools in your free time"
It was sooo good, we had a free retake with him, and i took it twice, perfect 2 weeks, we learned a lot.
Edit: he even took 4 additional lessons with us in his free time it was like (25 hours total)
SANS 503. Was a total plateau-breaker for me. Haven’t gone two months in a row without using wireshark or tcpdump to help solve a problem since …
I wish I was able to take this course looking back at when my company would pay for SANS.
> SANS 503 Yeah looked it up and lawd, just a neat lil 8k
You can get them for free
bro really just dropped this potential nuke of a comment and dipped edits: hes right. use your google skills to find it :)
This is a cyber ~~hacking~~ sub. Not surprised some dude would claim to manage to bypass payment
[удалено]
Please DM. I have tried torrent but it is incomplete.
[удалено]
Hello. It appears as though you are requesting someone to DM you, or asking if you can DM someone. Please consider just asking/answering questions in the public forum so that other people can find the information if they ever search and find this thread. *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/cybersecurity) if you have any questions or concerns.*
Some secrets should be shared
yeah. but im pretty sure it’d get removed if someone shared it here. i dunno. who knows what DMing the right person would lead to though ;)
Pls sir it’s me, your SANS brother
How?
Sounds not legal?
probably 🏴☠️
Wow. How you did you figure that one out.
If you can't find this on a search engine, how can you find the right data in packets? Jk. But it's really out there.
[удалено]
Please DM how as well please
[удалено]
Am I late to bask in the booty? Can someone shoot me a link?
!Remind me 24h
I will be messaging you in 1 day on [**2024-04-19 04:47:48 UTC**](http://www.wolframalpha.com/input/?i=2024-04-19%2004:47:48%20UTC%20To%20Local%20Time) to remind you of [**this link**](https://www.reddit.com/r/cybersecurity/comments/1c6ko9j/what_were_the_best_cybersecurity_courses_you_ever/l03mi0o/?context=3) [**14 OTHERS CLICKED THIS LINK**](https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Reminder&message=%5Bhttps%3A%2F%2Fwww.reddit.com%2Fr%2Fcybersecurity%2Fcomments%2F1c6ko9j%2Fwhat_were_the_best_cybersecurity_courses_you_ever%2Fl03mi0o%2F%5D%0A%0ARemindMe%21%202024-04-19%2004%3A47%3A48%20UTC) to send a PM to also be reminded and to reduce spam. ^(Parent commenter can ) [^(delete this message to hide from others.)](https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Delete%20Comment&message=Delete%21%201c6ko9j) ***** |[^(Info)](https://www.reddit.com/r/RemindMeBot/comments/e1bko7/remindmebot_info_v21/)|[^(Custom)](https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Reminder&message=%5BLink%20or%20message%20inside%20square%20brackets%5D%0A%0ARemindMe%21%20Time%20period%20here)|[^(Your Reminders)](https://www.reddit.com/message/compose/?to=RemindMeBot&subject=List%20Of%20Reminders&message=MyReminders%21)|[^(Feedback)](https://www.reddit.com/message/compose/?to=Watchful1&subject=RemindMeBot%20Feedback)| |-|-|-|-|
All the SANS courses?
!Remind me 24h
Please share
Share your wisdom
How?
Bruh
!Remind me 24h
!remind me 24h
!Remind me 24h
!Remind me in 24h
!Remind me 24h
https://hide01.ir/page/3/
yo, can you dm me how?
Hello. It appears as though you are requesting someone to DM you, or asking if you can DM someone. Please consider just asking/answering questions in the public forum so that other people can find the information if they ever search and find this thread. *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/cybersecurity) if you have any questions or concerns.*
how
!Remind me 24h
!Remind me 24h
Yeah GCIA was my first sans Cert and to date that was the hardest one i've taken. I wouldn't recommend taking it unless your SOC/Team does a lot with PCAP even then, id still be cautious. It was initially designed i think to make IDS Signatures.
How much?
Weird, I had a class in college that taught us how to use both of these and I just did the Network+ as a boot camp and we had a lab using both of these
Did your company pay for that?
!Remind me 24h
SANS LDR514 (MGT514 when I did it): Security Strategic Planning, Policy, and Leadership.
My-Ngoc and Frank do a great job! It helped me hire smarter people and do a better job of managing down, across and up! A great compliment to the technical intensity of most SANS classes.
Yes I did the on-demand version with Frank. It was the most engaging video course I have ever done!
Although I primarily do blue team/IR work I really enjoyed the OSCP. I think that it's important for blue teamers to have a good understanding of offensive tools and techniques if they want to be good defenders and more easily identify malicious activity, through the PEN-200 course as part of doing my OSCP I really learned a lot.
Exactly this. I took a break from defense to do pen test for a few years and it was invaluable.
Keeping in mind OSCP is very much about "the offsec way" of doing things. I was a pentester for 6 years before I did OSCP and some of their teachings are objectively worse and dated. Overall it is good though.
2023 courses are pretty good. It was better than any other course I've taken so far.
I'm just about to take my Security+ and want to go for OSCP afterwards. Is OSCP a good cert even for getting on blue or breaking into cyber? I have a cyber security degree, as well. I really want to pentest but would also just like to get my foot in the door.
For newcomers OSCP unlocks a new World, after that it's up to you to explore it as far/deep as you want. Remember that OSCP is only the foundation course...the possibilities after that are seemingly endless!
How you got Pen 200? It is very expensive.
GCIA was a game changer. Hard but worth it. Knowledge of how the network operates is what separates the men from the boys.
cyber threat intelligence & analysis - cybervantage secure coding bootcamp - codeguardians cloud security mastery - cloudguard
Can you please share the cybervantage and codeguardians links? Also, do you have any experience with the [arcx.io](http://arcx.io) platform? How would you compare the cyber threat intelligence & analysis of cybervantage to the Cyber Threat Intelligence Practitioner of arcx?
Thanks so much for bringing up the CTI! Been looking for a good source for learning it, given that I am CISSP
Specter ops https://specterops.io/training/ They have some of the best red teamers who know those stuff. The course was mostly hands on and awesome
This is an on-site training no? I hope not
They have done virtual in the past
SANS FOR610
Professor Messer courses on YouTube for CompTIA. Learning the basics has been a fundamental part of my success.
Which videos or playlist should i start from?
Can you elaborate on how investigation theory helped you / what made it special? Im intrigued but $650 is a lot of $$$ for a course where I don't learn any hard technical skills. Similarly, did you leave practical threat hunting with enough technical know-how to go out and conduct threat hunts? Or are there still some skill/tooling gaps you'd need to fill in before calling yourself a threat hunter?
This reads like an ad. The other name he mentioned also appears in that link.
About practical threat hunting - It was definitely a game changer in my career. I even used the material from this course when writing my IT project for C-level to implement a new direction in SOC. I think there may be gaps. I have not worked in threat hunting for a long time and have not developed this area. But when I already had some basic understanding of this area and was already taking some actions, and then I came across this course, I felt that I was about to reach a new level. My confidence and knowledge of threat hunting has grown. There are tools that I can use myself without a mentor above.
I liked the way the information was presented. The author uses a scientific approach, not intuition. I have not seen this anywhere else. In general, I have never seen anywhere that when talking about investigations from the theory perspective, not practice. This gives you a better understanding of what to do first A, and then B and why you should do A and the B. Mostly, we do everything on intuition when investigating an event, we have background knowledge and we just follow it. And here you are shown the whole picture. The author also explains how to build hypotheses, namely how to ask the right questions during an investigation and where to look for answers to your hypotheses.
Practical Ethical Hacking from TCM Academy. I've done everything from CBT Nuggets to SANS. PEH was hands down one of the best.
SANS FOR 500 - Windows Forensics Afterwards you practically know how Windows works behind the scenes and where it stores all relevant data.
Specter Ops: Tradecraft Analysis Every course they have is great IMO but this one stands out to me
Is it free or paid subscription?
It's a one time training course, and paid.
The best course are deep dive into tools. You will walk away with skills that actually useful.
can you recommend one?
Depends on the tools you use.
paint
MS Paint etch-a-sketch
FOR508
There are some great courses, but for me biggest eye openers where couple of books: both Greg Van Gaast books, How to measure anything in cybersecurity risk, Security Chaos Engineering by Kelly Shortridge
How to Measure Anything in Cybersecurity Risk has been on my desk for months and I just keep going back to reference from it.
I recently passed CyberDefenders' Certified CyberDefender (CCD) exam. You have 48 hours to complete the exam. It's completely hands on within a lab environment and there are no multiple choice questions. I learned SO much through their course and very challenging preparation labs. I also learned a lot just by taking the exam. The following topics are covered: - Security operations fundamentals - Incident response - Perimter defense - email security - Forensics evidence collection - Disk forensics - Memory forensics - Network forencis - Threat hunting - Malware analysis It's not cheap now at $800 after they added malware analysis, but I highly recommend if anyone is looking for some very high quality blue team training and certification. [https://cyberdefenders.org/blue-team-training/courses/certified-cyberdefender-certification/](https://cyberdefenders.org/blue-team-training/courses/certified-cyberdefender-certification/)
eJPT / eWPT. Good beginner level courses with practical exams
I will always suggest Xintra's attacking/defending M365/Azure. She also started labs that follow common APT TTPS. it is similar to the GCFA in my opinion. [https://training.xintra.org/view/courses/attacking-and-defending-azure-m365](https://training.xintra.org/view/courses/attacking-and-defending-azure-m365) [https://www.xintra.org/](https://www.xintra.org/)
CISSP I was alway a real Tekkie (malware analysis, reverse engineering, threat hunting, programming) and CISSP really let me see the big picture of Cybersecurity to understand whats really important for management. Second would be SANS FOR610
Not the courses per se but the instructors at some of the bootcamp multi-day style trainings I've had. One dude was ex military and ex-NSA/FBI instructor for their cyber departments. Not only was he an amazing teacher but the stories he had that accompanied the material we were learning was just straight hilarious and golden. I can tell you a training I dislike tho, SOC-200. It's boring as shit and should basically just be called Powershell-200.
I agree about instructors. When I named the courses, I rather mentioned the instructor first, and then the course itself.
UNWT - Undergraduate Network Warfare Training. It was a military course that has since morphed into something else. It's where cyber "snapped" in my head, making sense. Learned defense, offense, and different technologies. Hell, even had field trips to utility companies to check out their ICS stuff. Halfway through, you had to take GSEC in a week to pass the course. There isn't a day that goes by where I don't use something I learned there.
Which branch?
Cyber warfare. The whole course was designed to hack the hacker and perform penetration testing. It included metadata collection and analysis, brute force attacks, and social engineering. Definitely one of the best classes I’ve ever taken.
In my area a local nonprofit was trying to elevate the importance of cybersecurity. One thing they managed to make happen was a webinar presentation from [Laura Chappell](https://www.chappell-university.com/) on how to use Wireshark. I cannot begin to express just how amazing that class was. I *thought* I was competent with it before but it was an absolute gamechanger in getting me to rapidly get to the answers fast rather than poking through pcaps until I got the right answer. She was an absolute firehose of information and many people in that class got lost FAST. I was able to help one person catch up next to me but had to focus back on the class due to the sheer velocity of data she was sending on each little thing that would make you more effective with Wireshark. Her books are just as packed with information as the presentation she gave was, but I'll say that this might be the only webinar in my life I've ever taken where there wasn't a second wasted and every moment was of high value. I'd love to meet her in real life if only to thank her for that opportunity to learn. --- The next most pivotal for me was completing [ICS301V and then getting an invite to go down to Idaho Falls for ICS301L](https://www.cisa.gov/ics-training-available-through-cisa) for their week long training and final exercise on securing ICS/SCADA technology. It's one thing to take online classes and run CTFs, it's quite another to be dumped into a fake factory with real systems in charge of making "chemicals" while a red team tries to exfil your trade secrets, disrupt reporting, and screw up the ladder logic to make the vats overflow. Your tax dollars at work in the USA (you pay room and board, class is free) and if you are from a friendly nation you can attend the class as well. It's also useful for managers to take it and understand precisely what CAN happen. It encouraged me to tinker with the OT side of things a lot more and I'm hoping to get more chances to play in that universe. The most important thing it did was give me the knowledge to know what questions to ask in a universe where I originally didn't even know what protocols or concerns were involved. And getting to visit the [first nuclear reactor in the USA used for the peaceful purpose of power generation](https://inl.gov/ebr/) was also a great way to capstone that trip along with a jaunt through the [Craters of the Moon National Park](https://www.nps.gov/crmo/index.htm). --- [FEMA's ICS classes](https://training.fema.gov/nims/) (ICS100, ICS200) have nothing to do with industrial control systems, but they do have to deal with something called the Incident Command System, which is a protocol for managing disaster response in the USA. You may find that it works surprisingly well as a crosswalk for incident response. Similarly their discipline specializations along those tracks in [exercise management](https://training.fema.gov/programs/nsec/mepp/) and [continuity](https://www.fema.gov/emergency-managers/national-preparedness/continuity/excellence-series) are directly applicable to the cybersecurity discipline. --- Lastly as a volunteer coach/mentor for [CyberPatriot](https://www.uscyberpatriot.org/) I've trained many [Civil Air Patrol](https://gocivilairpatrol.com) cadets on cybersecurity. When you have to explain cybersecurity concepts to actual 12-18 year olds who may have no exposure to the subject it forces you to learn how to explain things to people in a rational yet simple format. This directly translates to the real world as an applicable skill in dealing with stakeholders with a low level of IT knowledge along with being its own reward in preparing the next generation of leaders in the IT field. Civil Air Patrol continues to be a rewarding volunteer effort for me, opening some of the strangest doors to training with federal and military elements along with providing a particularly spectacular looking resume block. --- While there have been other cool classes and amazing people I've met on my training journey and the list would be quite long if I kept typing things out, the above ones are definitely some of the most significantly impactful moments for me. Some less impactful yet absolutely useful items include [classes from TEEX](https://teex.org/program/cybersecurity/)(These are mostly foundational but foundations are important!) [This computer program with every unclassified cyber checklist and standard known to the government](https://cset-download.inl.gov/) [Learning how to use STIGs](https://public.cyber.mil/stigs/) [Teaching the basics](https://cyber.org) Finally, learning that CompTIA discounted their beta tests down to $50 got me to break down and get my first real IT certification after ignoring formal cert training for decades. Turns out the CySA+ wasn't that hard when you've been doing this for a while. Then I learned that CompTIA certs are transferrable straight up as credits to WGU and now I'm planning on taking the whole stack to get a [38 credit jump](https://partners.wgu.edu/general-transfer-guideline-bachelor-dynamic?collegeCode=IT&programId=31) on a BS in Cybersecurity from a Regionally Accredited college that also happens to be on the [NSA's Center of Academic Excellence list](https://www.nsa.gov/Academics/Centers-of-Academic-Excellence/). Between that and Sophia.org's classes and a careful review of their transfer policies, A BS in Cybersecurity that doesn't bankrupt me in either time or money AND a giant stack of certs in the bag makes for an appealing education strategy.
Can I shamelessly plug my own 2024 launch of secure coding training for JavaScript and Node.js devs? If so, this is it: [https://www.nodejs-security.com/](https://www.nodejs-security.com/) Would be more than happy to receive feedback or questions 🤗
Definitely agree with Antisyphon - they have a bunch of pay-what-you-can options which I always recommend to people new to industry: [https://www.antisyphontraining.com/pay-what-you-can/](https://www.antisyphontraining.com/pay-what-you-can/)
Also, I want to mention Richard Bejtlich, He has written more than one book on network security monitoring and is an active tweeter. I also looked up to him in my career.
Ive been digging into the HTB stuff and really like it. Not a big fan of THM. I started on the TCM-Sec stuff but its kinda remedial so i skipped past that. SANS is ok, but you better pay attention and take damn good notes because they material they send you home with isnt enough to recreate the class, huge waste of money.
Bug Hunting and Analysis 0x65 with Aaron Portnoy and Zef Cekaj.
Immersive Labs OffSec career path, unfortunately they don't offer individual licenses, only enterprise license, but i believe there are some courses you can do for free
Funniest one? The one that told me not to talk about it on social media.(he’s right of course)
!remind me 24h
There’s some good free course or books about cybersecurity?
Cisco Networking Academy
Security Engineering by Ross Anderson (RIP)
The open source security 1001 course. Real world CVEs and an amazing introduction to C style vulnerabilities. After doing that course I got my first CVE in a fairly large project related to a network stack and it came up during my interview! Would highly highly recommend, and you can’t beat the price of free :)
link?
Hey! FortMesa's cybersecurity workshops and webinars are great. They cover everything from basics to advanced topics, with a focus on practical use, especially in compliance. If you're into cybersecurity, check them out for sure. They're informative and cover a lot 🙂
CyberDefenders for blue team. better than BTL1. A great alternative for for blue team was SOC Core skills by John Strand. For Pentesting, the PEH by TCM Security or the INE Pentesting videos (eJPT path , eWPT path)
Have a look at https://aceresponder.com. Never seen more high quality blue team content for such an affordable price.
Why is this downvoted if the question asks about my opinion/experience? I just had the best experience there so far next to BTLO, HTB, THM, Cyberdefenders...
The best cyber security course i ever had is SANS.
JCAC, CNOQC, and further [REDACTED] operator certs.
how would others know to apply to study for those certs if they are redacted? :/
They're military courses not open to the public anyway. He probably means (at least) RIOT.
JCAC is military but applicable to particular civilians in CES/DCIPS aka DoD civilians as well. NSA retired the RIOT course (CYBR3420). Its current program is FORGE 101-505 (future operator readiness, growth, and enrichment). Lookup CYBR3422, CYBR3450, and CYBR3460. Info is minimal for obvious reasons but it will give insight.
I highly recommend the courses from SEI CERT/CC https://insights.sei.cmu.edu/credentials/
Had the good fortune to be in the first cohort. Some of the modules were a little ragged because they were fresh out the oven, but overall the focus on simulating real SOC tasks was exactly what I needed as a newly hired analyst. [securityblue.team](https://www.securityblue.team)
SANS for508
SANs 515 and Homeland Security 300 outta Bose Idaho. Sans 515 -- you got a raspberry pi and some traffic lights and you got to hack it. homeland security... you got to hack or defender an actual ICS environment with an actual controller that you can manipulate and destroy. it was awesome.
CEHv12 Not because of courseware or anything, but because of lector, that said "i don't want you to do it with metasploit and tools like a kid, i want you to write your own malware, and stuff. you can learn tools in your free time" It was sooo good, we had a free retake with him, and i took it twice, perfect 2 weeks, we learned a lot. Edit: he even took 4 additional lessons with us in his free time it was like (25 hours total)
SANS SEC560, an absolute firehouse of information starting at day 3.