The Certification

The Practical Junior OSINT Researcher (PJOR) from TCM Security (TCMS) is designed to validate skills in foundational open source intelligence. This is another addition to the set of practical and hands-on assessments that TCMS has released in the last couple of years. Practical and hands-on exams/assessments are often significantly more rewarding than the classic multiple-choice test. They are also often much closer to the “real world” environment that these skills are supposed to be used in.

The PJOR is no exception to this pattern of certifications from TCMS, with the badge itself representing the achievement of studying a detailed foundational OSINT course and using this knowledge to conduct a real investigation and intelligence report. A person with the PJOR knows that they have gone further than most in validating their ability to investigate and report in the context of a security company or a red team operation.

The PJOR costs $200 and includes the Open Source Intelligence (OSINT) Fundamentals course from TCMS Academy. The voucher and course access are good for life, and the voucher comes with one free retake. Students, first responders, and military personnel may request a 20% off coupon, which brings the voucher to $160. On April 1st, 2024 the price of the junior level certifications from TCMS will go up to $250. $30/month gives one access to the whole course catalog from TCMS Academy, including the extremely highly regarded Practical Ethical Hacking course.

One of the only other OSINT offerings from a reputable security company is the SEC497 Practical Open Source Intelligence course + GIAC Open Source Intelligence (GOSI) certification from SANS. The total cost of this offering is $8,525, which is more than fifty-three times (53x) the discounted cost of the PJOR ($160). While I haven’t been able to experience the SANS version, I can safely say that it’s extremely unlikely to happen in the near future.

The Certification.

The Course

The OSINT Fundamentals course is a beginner level course, but this is only because OSINT can get extremely complicated and skillful the deeper one goes. One of the many subfields, Cyber Threat Intelligence, is often a more complicated security job than most.

The fundamental course starts on the ground floor, with heavy focus on search engines, social media, sock puppets, and finding locations with geographical clues or landmarks. The course is effective at bringing someone all the way to being able to independently reverse image search and examine images to pinpoint a location. The course also effectively teaches a novice how to use social media for information gathering or target acquisition.

Throughout the course the instructor (Heath Adams) maintains the importance of using these tools and skillsets for an ethical purpose and in an ethical way. Rather than use the knowledge from the course to abuse the trust of others, security professionals should be attentive in how to defend against the vulnerabilities that users and principals might unknowingly incur when others use these methods.

The Course.

The Exam

The PJOR exam is 72 hours long, and in that time the test taker must complete an investigation that answers all of the required criteria and supply the information in a report format. The main aspect of the exam (other than investigation) which could prove a challenge for test takers would be the requirement to show all methodology. Test takers should be careful to make sure that another person reading the report is able to replicate the methods used to answer the requirements.

The exam was engaging, fulfilling, and challenging. As mentioned earlier, the main reason this is a “Junior” exam is due to the complexity of the more advanced cybersecurity OSINT applications. This exam is not an easy breeze by any means. As one who has never done an OSINT challenge before, I had to rewatch most of the course material at least three more times during the exam in order to feel comfortable with using these techniques “in the wild”.

Report Template.
Written Review — SixSecure.
Written Review — HiroNewf.
Livestream Review—Shawn.

Why OSINT?

Open source intelligence (OSINT) should be considered a fundamental skill for learning technology in 2024. From help desk, to cybersecurity, to software engineering — being able to navigate the open sources of information available through networked technology can be vital to understanding even basic concepts in IT or computer science. Even basic concepts in these fields are often not so easily accessible. When moving onto more advanced topics it is essential to be able to find obscure information and assess the trustworthiness of that information.

Maybe you’re trying to break into cybersecurity, and have a million questions. Maybe you want to know how long it will take. Or what is the perfect certification for a beginner. Maybe you’re taking the OSCP exam and have been told by others to “get good” when you get stuck. Maybe you can’t find a worthwhile company to work with. Why reinvent the wheel? In many cases someone has already done the work for you. With the right skills and persistent attitude you can benefit from someone else’s experience and knowledge. You can troubleshoot obscure systems, find high quality learning material, and avoid vendors with low reputation.

Can you seek out and find the answer to a problem? What about finding the full solution, so you can get the answer yourself next time? What about finding three different solutions so you can see if one is more optimal? Investigating much further than the bare minimum is often a simple way that people will achieve swift understanding in complex topics. Many of the people who seem inordinately successful and skilled in an impossible amount of areas within something like cybersecurity are simply people who are very skilled at investigating and solving problems. Investigation and problem solving are often the root skills to other more complex areas in IT, cybersecurity, and computer science.

Security professionals must at least consider the OSINT skills of others. Basic search engines can show a surprising amount of personal details and other identifying information, any of which are vectors that actors are successful at exploiting. Some firms with a higher threat profile will even muddy the waters by seeding fake information about key individuals within the organization onto public sources.

Threat intelligence is a sophisticated form of OSINT that heavily relies on the openness in order to function. Without this openness, the public would be significantly more in the dark about the tactics, techniques, and procedures of threat actors.

Offensive security professionals might use each of these applications of OSINT in a single engagement: to troubleshoot an obscure technology issue, to find an obscure technology vulnerability, to find sensitive information about a company or key individuals, and to emulate or mimic a specific threat actor.

When it comes to cybersecurity specifically, using OSINT now extends to the way that community leaders are recommending the job search be conducted. Using OSINT on the company, on the workplace environment, on the hiring team, on the skills required by the role, on resources to learn those skills — are now often standard operating procedure for the higher achieving job candidates.

Conclusion

Investigating open sources might be one of the most integral skills to succeeding as a technology professional in the modern day. For those who want to find quality learning materials, find a quality career, find a quality workplace — the ability to pursue information will greatly determine one’s access to opportunities. For those who want to learn ethical hacking, penetration testing, or even have an ambition for red team operations — the ability to investigate and gather intelligence is essential to remaining competitive.

The PJOR is a great step in a person’s journey to expand and validate skills that are essential for a cybersecurity professional, especially a cybersecurity professional who wants to continue to grow in the area of offensive security. This is a rare type of certification — one that is highly relevant and applicable for beginners, experts, students, professionals, blue team, red team, and purple team alike.

The team involved in creating the PJOR is to be recognized and celebrated for bringing such an affordable and essential offering to the cybersecurity community. Anyone who successfully passes the assessment should be proud, having gained a skill and experience with more impact than most.

The following courses, learning paths, and diplomas are free as of this article’s publication. This list is not inclusive of every single free course available, in many cases these platforms have more than listed here. These courses are not necessarily dedicated to Cybersecurity, but are also dedicated to IT topics that can be important prerequisites to later concepts — like Cloud, Data, DevOps, and Programming.

Infosec Institute

• Learning Path: Infosec IQ Security Awareness
• Learning Path: Information Privacy Fundamentals
• Learning Path: NIST Cybersecurity Framework
• Learning Path: Incident Response
• Learning Path: Identity and Access Management
• Learning Path: Security Architecture
• Learning Path: Digital Forensics Concepts
• Learning Path: Mobile Forensics Fundamentals
• Learning Path: ICS/SCADA Security Fundamentals
• Learning Path: Cybersecurity Leadership and Management
• Learning Path: DevSecOps
• Learning Path: Python for Cybersecurity
• Learning Path: JavaScript Security
• Learning Path: Applied ChatGPT for Cybersecurity

Palo Alto Networks

• Introduction to Cybersecurity
• Fundamentals of Network Security
• Fundamentals of Cloud Security
• Fundamentals of SOC (Security Operations Center)
• Advanced SOC Concepts

Cisco Networking Academy

• Career Path: Junior Cybersecurity Analyst
• Career Path: Network Technician
• Introduction to Packet Tracer
• Operating System Basics
• Computer Hardware Basics
• Cybersecurity Essentials
• Networking Essentials
• Python Essentials 1
• Python Essentials 2
• JavaScript Essentials 1
• Data Analytics Essentials
• Ethical Hacker

ISC2

• Certified in Cybersecurity (CC)

The Linux Foundation

• Cybersecurity Essentials
• Secure Software Development: Requirements, Design, and Reuse
• Secure Software Development: Implementation
• Secure Software Development: Verification and More Specialized Topics
• Developing Secure Software
• OWASP Top 10 Security Threats
• Introduction to DevSecOps for Managers
• Fundamentals of Quantum Computing
• Quantum Computing Essentials for Senior Leaders
• Introduction to Quantum Circuits

Qualys Learning Center

• Endpoint Detection and Response (EDR) — Foundation
• Vulnerability Management — Foundation
• PCI Compliance — Foundation
• Policy Compliance — Foundation
• VMDR Self-Paced Training
• CyberSecurity Asset Management Self-Paced Training
• Scanning Strategies and Best Practices Self-Paced Training
• Reporting Strategies and Best Practices Self-Paced Training
• Patch Management Self-Paced Training
• Administration Module Self-Paced Training
• PCI Compliance Self-Paced Training
• Web Application Scanning Self-Paced Training
• Cloud Agent Self-Paced Training
• Cloud Security Assessment and Response
• File Integrity Monitoring Self-Paced Training
• Container Security Self-Paced Training
• Qualys API Fundamentals Self-Paced Training
• Endpoint Detection and Response (EDR)
• Qualys Query Language (QQL)
• Custom Assessment & Remediation (CAR)
• Qualys Flow (QFLOW)
• Policy Compliance Self-Paced Training

Microsoft Learn

• Learning Path: Microsoft Azure Fundamentals: Describe cloud concepts
• Learning Path: Microsoft Azure Fundamentals: Describe Azure architecture and services
• Learning Path: Microsoft Azure Fundamentals: Describe Azure management and governance
• Learning Path: Microsoft 365 Fundamentals: Describe Microsoft 365 apps and services
• Learning Path: Microsoft 365 Fundamentals: Describe Microsoft 365 security and compliance capabilities
• Learning Path: Microsoft 365 Fundamentals: Describe Microsoft 365 pricing, licensing, and support
• Learning Path: Microsoft Security, Compliance, and Identity Fundamentals: Describe the concepts of security, compliance, and identity
• Learning Path: Microsoft Security, Compliance, and Identity Fundamentals: Describe the capabilities of Microsoft Entra
• Learning Path: Microsoft Security, Compliance, and Identity Fundamentals: Describe the capabilities of Microsoft security solutions
• Learning Path: Microsoft Security, Compliance, and Identity Fundamentals: Describe the capabilities of Microsoft compliance solutions
• Learning Path: Describe the basic concepts of cybersecurity
• Learning Path: Learn how Microsoft supports cloud adoption as part of a cybersecurity solution
• Learning Path: Get started with Windows PowerShell
• Learning Path: Automate administrative tasks by using PowerShell
• Learning Path: Manage cloud resources by using Windows PowerShell
• Learning Path: Create and modify scripts by using Windows PowerShell

AWS Skill Builder

• Learning Path: Cloud Essentials
• AWS Cloud Quest: Cloud Practitioner
• Learning Path: Solutions Architect
• Learning Path: Cloud Operator (SysOps)
• Learning Path: Security
• Learning Path: Security: Data Protection
• Learning Path: Security: Compliance
• Learning Path: Security: Identity & Access Managment
• Learning Path: Security: Threat Detection and Incident Response
• Learning Path: Infrastructure Security
• Learning Path: Data Analytics
• Learning Path: Database Fundamentals
• Learning Path: Developer
• Learning Path: Containers
• Learning Path: DevOps Engineer
• Learning Path: Machine Learning
• Learning Path: Decision Maker

Cybrary

• Career Path: IT and Cybersecurity Foundations
• Introduction to IT & Cybersecurity
• Network Fundamentals
• Linux Fundamentals for Security Practitioners
• Intro to Python
• Python for Cybersecurity Professionals
• Fundamentals of Cybersecurity Architecture

AttackIQ Academy

• Learning Path: Summer School 2023
• Learning Path: From Concept to Practice: Applying the World-Class Research of the Center for Threat-Informed Defense
• Learning Path: Security Leadership
• Learning Path: Intermediate MITRE ATT&CK
• Learning Path: Intermediate Purple Teaming
• Learning Path: Intermediate Breach & Attack Simulation

EC-Council

• Network Defense Essentials (NDE)
• Digital Forensics Essentials (DFE)
• Ethical Hacking Essentials (EHE)
• Introduction to Dark Web, Anonymity, and Cryptocurrency

Roppers Academy

• Computing Fundamentals
• Practical Networking
• Capture the Flag (CTF) Bootcamp
• Security Fundamentals
• Technical Security Fundamentals

freeCodeCamp

• Information Security

Security Blue Team

• Introduction to Network Analysis
• Introduction to OSINT
• Introduction to Digital Forensics
• Introduction to Dark Web Operations
• Introduction to Threat Hunting
• Introduction to Vulnerability Management

APIsec University

• API Security Fundamentals
• OWASP API Security Top 10
• API Documentation Best Practices
• API Security for PCI Compliance
• API Penetration Testing

OPSWAT Academy

• Introduction to Critical Infrastructure Protection

Maltego

• Maltego Foundations 1
• Maltego Foundations 2

arcX

• Cyber Threat Intelligence 101

SoloLearn

• Tech for Everyone
• Coding Foundations
• Introduction to Python
• Python Intermediate
• Python Developer
• Introduction to JavaScript
• JavaScript Intermediate
• Introduction to SQL
• SQL Intermediate
• Introduction to C
• Introduction to C#
• Introduction to C++
• Introduction to HTML
• Introduction to CSS
• Introduction to Java

Kaggle

• Intro to Programming
• Python
• Intro to Machine Learning
• Pandas
• Intermediate Machine Learning
• Data Visualization
• Feature Engineering
• Intro to SQL
• Advanced SQL
• Intro to Deep Learning
• Computer Vision
• Time Series
• Data Cleaning
• Intro to AI Ethics
• Geospatial Analysis
• Machine Learning Explainability
• Intro to Game AI and Reinforcement Learning

Cyber5w

• Prepare Your Forensic Environment
• Working with Virtual Hard Disk
• Introduction to Evidence Acquisition
• Introduction to Digital Forensics
• Linux Forensics Distributions
• Writing Forensics Reports
• Computer Data Representation
• Intro to Linux from a Forensics Perspective — Tsurugi Version
• Intro to Linux from a Forensics Perspective — Ubuntu Version
• IoT Forensics Fundamentals

APNIC Academy

• Cybersecurity Fundamentals
• Routing Fundamentals
• Mutually Agreed Norms for Routing Security (MANRS)
• OSPF (Open Shortest Path First)
• IPv6 Fundamentals
• IPv6 Address Planning

Saylor Academy

• CS101: Introduction to Computer Science I
• CS102: Introduction to Computer Science II
• CS105: Introduction to Python
• CS107: C++ Programming
• CS120: Bitcoin for Developers I
• CS201: Elementary Data Structures
• CS202: Discrete Structures
• CS250: Python for Data Science
• CS301: Computer Architecture
• CS302: Software Engineering
• CS401: Operating Systems
• CS402: Computer Communications and Networks
• CS403: Introduction to Modern Database Systems
• CS406: Information Security

CSU — IT Masters

• Information Security Incident Handling
• Enterprise Cyber Security Fundamentals
• Computer Network Fundamentals
• Digital Forensics
• Cryptography
• Pen Testing
• Applying Law to Emerging Cyber Dangers
• Cyber Warfare and Terrorism
• Detecting and Defending against Cyber Threats
• Ransomware Techniques
• Cyber Defence Strategies
• Practical AI for Non-Coders
• Cybersecurity Management

Alison*

• Diploma: Cybersecurity
• Diploma: Risk Management
• Diploma: Identity and Access Management
• Diploma: Digital Forensic Investigation
• Diploma: Ethical Hacking
• Advanced Diploma: Cryptography

*Can get certificate ID and add to LinkedIn for free — digital copy costs money.

Oxford Home Learning Center

• Diploma: Cybersecurity
• Diploma: Risk Management
• Diploma: Security Management

Forage

• Virtual Internship: Mastercard Cybersecurity
• Virtual Internship: Datacom Cybersecurity
• Virtual Internship: JPMorgan Chase & Co. Cybersecurity
• Virtual Internship: ANZ Cybersecurity
• Virtual Internship: AIG Cybersecurity
• Virtual Internship: Telstra Cybersecurity
• Virtual Internship: PwC Cybersecurity

Harvard University — CS50

• CS50’s Introduction to Computer Science
• CS50’s Introduction to Programming with Python
• CS50’s Introduction to Artificial Intelligence with Python
• CS50’s Introduction to Cybersecurity (coming in October)

FedVTE

• 101 Coding for the Public
• 101 Critical Infrastructure Protection for the Public
• 101 Reverse Engineering for the Public
• Cloud Computing Security
• Cloud Security — What Leaders Need to Know
• Cryptocurrency for Law Enforcement for the Public
• Cyber Supply Chain Risk Management for the Public
• Cyberessentials
• Don’t Wake Up to a Ransomware Attack
• Foundations of Cybersecurity for Managers
• Fundamentals of Cyber Risk Management
• Introduction to Cyber Intelligence
• Securing Internet-Accessible Systems
• Understanding DNS Attack
• Understanding Web and Email Server Security

CDSE

• Cybersecurity Awareness
• Introduction to the Risk Management Framework (RMF)
• Derivative Classification
• Original Classification
• DoD Initial Orientation and Awareness Training
• DoD Annual Security Awareness Refresher
• DoD Mandatory Controlled Unclassified Information (CUI) Training
• Identifying and Safeguarding Personally Identifiable Information (PII)
• Marking Special Categories of Classified Information
• Unauthorized Disclosure of Classified Information and Controlled Unclassified Information
• Establishing an Insider Threat Program for Your Organization
• Insider Threat Awareness
• Maximizing Organizational Trust
• OPSEC Awareness for Military Members, DOD Employees and Contractors
• Counterintelligence Awareness and Reporting Course for DOD
• Counterintelligence Awareness and Security Brief
• Counterintelligence and Threat Awareness Information to the Defense Industrial Base

CHDS

• Cybersecurity — A Primer
• The Advanced Persistent Threat: An Overview of Adversarial Nation State Cyber Operations against the United States
• Systems Thinking
• Intelligence for Homeland Security: Organizational and Policy Challenges
• Social Network Analysis: An Introduction
• Research Process and Methods
• Deception Detection Techniques
• Cognition & Information
• The History of Homeland Security
• Futures Studies for Homeland Security

This article is the culmination of over six months of research, which in many cases included taking these courses to confirm receipt of the certificate. Feel free to let me know if there are free courses or learning paths that should be on this list!

Free Resources from WGU:

Pluralsight: Pluralsight offers courses and learning paths taught by experts geared around industry certifications in IT and Cybersecurity, such as those offered by Cisco and CompTIA.

LinkedIn Learning: LinkedIn Learning offers courses and learning paths taught by experts in both soft skills and technical skills. Courses vary from a half hour to more than four hours.

Udemy: Udemy Business offers courses taught by experts that are often expensive when sold individually. Udemy has some very in-depth and long (twenty hours+) courses that focus on specific areas within IT and Cybersecurity. [for students in the College of IT]

Percipio (by Skillsoft): Percipio is a learning platform that offers courses centered around industry certifications. This platform also has courses for business and technology skills.

CompTIA CertMaster: CertMaster has labs, learning exercises, flashcards, minigames, and practice exams made by CompTIA for each of the certifications offered. These practice exams help identify specific areas to return to when studying.

DataCamp: DataCamp has learning paths and certifications for Data Analysts, Data Engineers, and Data Scientists. The courses and learning paths are focused on Python, R, and SQL, with hands-on coding practice built into the lessons.

WGU Online Library: This library contains thousands of ebooks and academic publications available to read online and download. Check here if you get pay-walled when researching academic papers.

Handshake: Handshake offers students access to job postings, information webinars, and virtual career fair events.

WellConnect: WellConnect offers students and their immediate household a place to talk with a licensed therapist at no cost. Legal, financial, and health and wellness resources are also available (including thirty minute free legal consultations).

Instructions: to access these platforms — click the link from inside WGU’s website, sign in with WGU email address, type “wgu” into the beginning of the URL (example: “wgu.pluralsight.com”), or be logged into WGU student portal and use single sign-on (SSO).

Other Free Resources:

Microsoft Azure: Microsoft Azure offers a $100 credit (no card required) to students who verify their school email address. Microsoft Azure also has student Dev Tools available, such as Windows 10 Education, Windows 11 Education, Visual Studio, Visio Professional, and more premium software.

Microsoft Office 365: Office 365 allows full access to Microsoft Word, Excel, PowerPoint, Teams, OneNote, and OneDrive. Many of these are usable through the browser app with no downloads necessary. Some also have integrations with WGU (the Cybersecurity Club uses Teams and OneNote).

Amazon Web Services (AWS): Amazon offers AWS Educate, which helps students learn cloud concepts; AWS SkillBuilder, which helps students prepare for AWS certifications; and AWS Cloud Club Learner Library on GitHub. Check out more AWS student resources at the developer community page.

Notion: Notion is a popular note-taking app that stores in the cloud and automatically syncs. Notion can be accessed through a dedicated app or through the browser.

Github Student Developer Pack: A huge list of free offers including:

• Free GitHub Pro.
• Free GitLens+ Pro.
• GitHub Codespaces Pro.
• Free subscription to JetBrains (IDE software).
• $200 credit for one year on DigitalOcean (cloud hosting).
• One year of free domain registration (.me) by NameCheap.
• One year of free domain registration (.live) by Name.com.
• One year of free domain registration (.tech) by .tech domains.
• One year of free 1Password (password manager).

Discounted Resources:

VMWare: VMWare offers students a discount on virtualization software.

Hack The Box Academy: students receive special pricing ($8 / month).

TryHackMe: students receive special pricing (~$8 / month).

Students and Alumni of WGU can utilize hundreds or even thousands of dollars worth of courses and training for free. For many students, having access to platforms like LinkedIn Learning and Udemy Business for free can advance their learning far beyond the degree program.

This value comes from a few directions:

• The price of tuition is extremely affordable, a fraction of the price of many four-year university degrees.
• The program is online, and the curriculum is a competency-based learning model, both popular with students and efficient for professionals.
• The Cybersecurity degree program helped WGU achieve the designation of National Center of Academic Excellence in Cyber Defense from the National Security Agency (NSA) and the Department of Homeland Security (DHS).
• The university is regionally accredited - “In 2003, the university became the first school to be accredited in four different regions by the Interregional Accrediting Committee.” - Wikipedia (currently accredited by NWCCU)
• The program currently offers up to fifteen industry certifications as part of the completion of certain courses.
• The Cybersecurity Club is very active and helpful with both education and career resources.
• Numerous free benefits including Pluralsight, LinkedIn Learning, and Udemy.
• Supports students with Program Mentors, Course Instructors, Writing Center, Math Center, Career & Professional Development Center, and more.

…And the list could go on. There are many Alumni of the Bachelor’s and Master’s degree programs who are currently employed at some of the highest levels in the Cybersecurity industry. One can come across hundreds of positive testimonials on various social media platforms.

Though the average time for students to graduate is 32 months, this depends on how many credits the students is able to transfer (some transfer more than half of their degree). Some students are also able to complete all courses within the program (no transfers) in six months or less. This is the power of competency-based education.

Each class is completed with either a Performance Assessment (PA) or an Objective Assessment (OA). A PA is usually at least one long essay or written project, often being a technical report combined with an executive summary. An OA is often a proctored exam that results in an industry recognized certification, or a proctored exam through WGU.

This degree program benefits from an extremely helpful network of students sharing resources that helped them succeed in these classes. As a result, one can find Night Owls sharing their tips on Reddit, Discord, Twitter/X, YouTube, LinkedIn, and in the built-in communication features of the school.

This degree program is for anyone who has the drive to learn. A massive amount of people have pivoted from other careers to learn Cybersecurity from WGU. For many of these students, it costs much less than the price of a Cybersecurity bootcamp.