The Pros and Cons of Courses

by Seeker7  (seeker8306@gmail.com)

Many people in the hacker community tend to frown or look down upon so-called "ethical" hacking and network security courses.  I think that there are two reasons for this.

First, there tend to be a group of people who assume that because they have a piece of paper stating that they are "certified" in something, it means that they are now "experts" and know everything about the topic at hand.

Second, why pay for a course in something that can probably be learned on your own through websites, newsgroups, books, videos, and other sources readily available online?  However, I would like to make the argument that there are some benefits in taking a course in network security, provided that you find the right one and with a few additional understandings or considerations.

First, let me give you some background on myself.

I started my hacker journey in middle school.  I was inspired by the idea of being "cool" or doing something that I shouldn't, but soon found the sheer joy of learning new things to be far better.  That being said, as I progressed into high school, I seemed to forget those interests and pursued other things.  It isn't to say I haven't been actively learning new things about computers until recently, just that I have been more inspired of late.

Basically, I am not a very motivated individual.

I'll get excited about something for a month or so, really invest time into it, and then abandon it for something new.  I have a computer in my basement that has been a web server, PBX, and a Windows Home Server, all just for hahas in a three year period.  But, because I only gain the basic knowledge and operation on something and lose interest, I never have the opportunity to really dive deep.  Call it a personal flaw.  The only reason that I feel motivated to stick with something is if I am accountable to someone other than myself.  A class or course provides the kind of structure that I need in order to stay focused.

Now, at one point in my life, I actually attended a computer learning center for A+ and Network+ but, due to my job schedule at that time, I couldn't put myself into a place where I felt comfortable taking the tests.  Luckily, I can go back and retake the courses for free, but they were very expensive.

In fact, now that I reflect on it, they are probably a complete rip-off.  Would I be using them for any networking courses in the future?  No.

Not only that but I have found that many "hacker" classes only teach you "script kiddie" stuff.  They show you how to use existing applications but don't teach actual thought processes, why the applications work, and how to develop your own tools.  They might give someone a general background but won't be worth anything in the end.  So, I did some looking around.

BackTrack is one of the better penetration and security suites available.

It has a lot of great tools built into it, and also is heavily customizable.  I could take the time to play with BackTrack and learn each of the tools, how they function, etc., and have done some exploring on my own.  However, I know that I am not motivated enough to really dive deep into their functionalities.  I then found that the people who develop BackTrack have a course called "Pen-Testing with BackTrack" and it has some kind of certification attached to it, which I honestly don't care about.

Now, before everyone jumps down my throat and says "C'mon Seeker, really?" let me tell you that I did my homework here.  I took a look at the actual course syllabus.  This course does go through many of the tools in BackTrack and their use, however, it goes much further than many courses I have seen.  They actually teach things like Bash and Python scripting - you know, making your own programs should the pre-designed ones not work for what you need.  Their "certification" test is actually applying what you learn and testing your thought processes by having you break into a network that they have set up and designed.

Basically, they don't teach just the tools.  They teach proper thinking and methodology.

"Oh great, so if Seeker takes this course, he'll think he's an awesome hacker and that he deserves huge credit with everyone."

No, I don't.

First, I'm not saying that I will necessarily be taking the course.

Second, the way I see it is that if I were to take said course, it would force me to sit down and really commit to something.  It would give me a primer on a lot of great things, and a much deeper primer than I could develop on my own, knowing my own personality.  I would not use this as a be-all-end-all and would not consider myself an "expert" in anything.

It would simply be a springboard for further learning on my own.  Sure, a certification looks great on a resume, and you'd be foolish not to put it on there, but I really don't care about that.  I care about the knowledge and the further ability said knowledge will give me to investigate and delve more deeply into things on my own.

So, yes, a lot of "hacker" certification courses are pretty dumb and teach nothing about real methodologies and thought processes.  Yes, a lot of people who take said courses go on to bill themselves as "security experts" who slap a baseline security onto some corporate network that will later be broken into by someone who actually knows what they are doing.  All that being said, I think if you shop around and have the right attitude, some courses would be beneficial and would simply aid in continued learning.

If anyone has any other ideas for someone of my particular personality and/or "hopping" interest level, by all means let me know.

I'm just making the point that courses can have their place.  They don't replace your own desire to learn and develop yourself, and shouldn't make you feel like a "god" of the industry.

If that is what you expect and want, then don't bother, because you will just end up being something that the hacker community generally looks down upon, and, worst of all, you will be preventing yourself from becoming the best that you can possibly be.