Update

2012 Mid-Year Update.

I haven't forgotten about the blog, I have just been busy. I am trying to better manage time and keep everything afloat, and seem to be failing right now. To get back on track I am doing a mid-year status check.

On the certification front, I passed the OSCP on my 2nd attempt. This time around I was more organized, focused and just overall better prepared. As someone who has taken a lot of certification test,  not failed, it was a shock. Once I regrouped, I sat the exam again and passed. I am still wanting to take a few more OffSec courses, but may not get through them this year. 

I have to pass the Cisco VPN 2.0 test to convert my CCSP to a CCNP Security in the next few weeks. I am torn about doing this certification, I dont do a lot of this type of work anymore, but I do occasionally, so I will go ahead and renew. In 3 years I have to take several  test to renew and may consider dropping the certification. 

One test that I thought was going to be an option was the GIAC Web Application Pen Tester (GWAPT), is in fact happening. I was able to take SANS SEC 542, which I hope to do a class review when I am done with the course, through SANS On Demand. I will probably take the certification in late August or early September. 

On the blog front, you can tell that I have not been doing a good job. I am gonna focus more on it over the next few months. I want to get more technical with the blog, like I had intended to and give people actual value.

For publications, I have only written one article so far but I hope to get a few more published. Not sure what I will write about but I will let you know.

On the python front, I am starting to use it more and more every day. So at least one of goals is starting to be accomplished :).

For the vulnerable ASP.NET app, well there is next year. 

So I know I am failing alot on my goals, but will redouble me effort to get them accomplished this year.

How to fail a certification test

My last post was all about Goals for 2012, and I will tell you I am already failing them. I have had a lot going on personally, nothing bad, just a lot going on right now. The only thing I have completed so far is I took the Offensive Security Pentesting with Backtrack class.

I highly recommend taking this class to anyone who works in Information Security. If you think a pentest consist of running a vulnerability scan and then maybe using metasploit to pop a system, you MUST take this course.

What I enjoyed about this class was the chaos in the labs. Most classes have labs were you follow a set procedure and you have root/admin. In the real world a pentest is not like that. Basically you are given a network address and told to attack. From there you penetrate further into the network using any number of techniques.

After the lab time expires you can register for the certification exam. The certification exam is like the lab, a number of systems must be rooted in a 24 hour period.

After registration I was prepared to sit the exam. When doing a test like this, I know when you get stuck on something move on to something else can come back later. Additionally, take breaks often to mentally recharge. I always do this for these types of test, except this time. I spent 18 hours on one problem with one 10-minute break, and made stupid mistake after stupid mistake. I lost complete confidence in myself after this and went to bed wiped out. I got about 4 hours of sleep, and pounded away to finish up and promptly fail the exam. Although I failed the exam I learned a lot during the experience, and I don’t mean technically. I plan to sit for the exam again in a couple of weeks, and this time I will much more prepared. This time, I am sitting a maximum 15 minutes on a problem and then moving on.

To summarize, on how to fail at a hands on certification, go in with a game plan and at the first issue throw out the game plan. Even though I failed the OSCP first time around, I will pass it. I failed the exam, not because I didn't know what to do, I failed it because I did not stick to my game plan. Next time I wont make that mistake.