Opinions on certifimication

OSCP is very hands on and practical but not well recognised. It is a hacking course, it is not a course about company security policies or the best way to set up your firewalls. Its about finding vulnerabilities in an application or system and then tinkering with whats out there to exploit the system you have found exposed. It wotn teach you to be a pentester but it will teach you everything you need to know about the hacking side of pentesting. The exam has zero theory and is completely hands on, think as you go rather than learn a load of facts and re-create your notes on a page.

CISSP, from what I can tell as I havent studied it, is more of a management overview of security including policy requiremetns, physical securty options etc. Its much more "blobby" than OSCP and more theoretical.

CEH is the red headed step child of those two. Its a quite fundamental course (read: basic) and perfect for the newcomer to the field of security. However, you wont learn a lot of practical pentesting on the course. You'll see a lot of utilities and demo a few. It does teach you what you need to look to learn next.

ECSA (the follow on from CEH) is pretty much CEH 1.5 . *a lot* of the same material is covered. IDS etc are briefly described.

Both CEH and ECSA have a multi choice exam at the end. both are simple for people that can memorise slides or take good notes (or have an instructor that runs through "sample" questions). However at the end of the courses you are NOT ready to proclaim yourself a Pentester or Security Analyst. You have an idea of where to go to learn more but thats about it.

I havent sat any of the SANS courses so I cant comment on those but they look good and some do offer a practical path (I think).

I also have no experience of the CHFI course (chfi? cfhi?). its not necessary for the ECSA but I cant see it being too in-depth, not enough to be able to confidently say "I can run a forensic analysis on that dodgy machine over there" but again, I'm sure it would be a good baseline to start from.

The one thing that struck me most (and saddened me most) about the ECSA course was that once you pass the ECSA you just have to pay $500 and you get a pentesting "license" which supposedly shows that you are qualified to offer your services as a pentester.... I decided to see if I could practise what I thought I knew before I considered shelling out for that particular piece of paper and got a quite nasty shock when I found myself completely out of my depth and relying more on my own research (OWASP, forums and experience) than the material I had "learned" on either the CEH or ECSA courses.

so, yeah, CEH & ECSA, great pieces of paper to have because they are recognised in the industry and will get spotted on a CV but you better make sure you have the experience and skills to back it up.

OSCP: not well recognised but those that have it or have attempted it will attest to just how impressive it is.

CISSP: no idea but there were a few CISSPs on the CEH course I sat and they knew lesss than I did about pentesting (and I didnt know much) so I'd be tempted to say that it too is more of a CV adornment than a mark of an experienced Security professional.

footnote 1: I think this is more to do with the way CISSP and CEH/ECSA are taught and examined than it is to do with the course ocntent itself. If you study CISSP the way it is recommended - over a period of a year, honestly have the necessary experience - then it should be brilliant but I've seen "bootcamps" where people go from zero to CISSP in three to 7 days - one guy I spoke to on the ECSA course did CEH, CISSP and CCNA in one 7 day bootcamp, he had no prior security or networks experience but had worked in IT (helpdesk) for 2 years before that.

footnote 2: I saw your post earlier but RL etc got in the way of responding and rather than rush out a response I wanted to wait until I had time to fully answer your question as best I could. I'm sure many of th eother viewers were of the same mind and I'm sure more than a few were spambots and shill machines crawlign to see if there was anything in your post that they could chime in with an advertisement disguised as something helpful "Dont have your CISSP? Thats because your willy is too small. click here to fix that using purely natural ingredients!" etc.