Want to get Certified as an
Ethical Hacker? Be careful which Certification you choose
CSTA & CSTP certification path review
Ethical hacking certification
can be obtained following training under penetration testing
experts, followed by taking recognised examinations. As any
techie worth their salt knows, to be able to defeat the
hackers, you first have to learn to think like one.
One such company offering certified ethical hacker certification
is 7Safe Information Security, with their university accredited CSTA and CSTP certifications.
The CSTA course includes a one hour multi-choice exam
which is taken after three days of intensive training during
the CSTA Ethical Hacking: Hands-On training course. This link page has
the course outline, a flash video course preview with funky
soundtrack and review by Linux Format magazine from November
2003. To obtain CSTA certification, there are additional university assignments to complete and earn Masters level credits towards a Postgraduate Certificate in Pen testing & Information Security.
Some of the most
interesting aspects of the training leading up to this ethical hacking certification (CSTA actually stands for Certified
Security Testing Associate) are working with penetration testing
/ ethical hacker tools such as Nessus, nmap and dumpsec, enum,
user2sid, sid2user, lrk4, knark, and bo2k etc etc. This training
course is packed full of practical exercises which I found
to be extremely well put together, and as 7Safe don't resell
products, it's a vendor-neutral experience, which makes a
nice difference from the usual (you'll know what I mean if
you've been on a CheckPoint, or ISS course).
In the CSTP ethical hacker certification (Certified Security
Testing Professional), things are taken one step further,
and you have to prove your practical skills by demonstrating
that you can walk the walk. The Hacking Insight: Hands-On
2 course is recommended before attemptingt the CSTP exam in
order to hone the knowledge gained in the first course.
The CSTP course covers a lot of advanced
techniques including how to set up stealthy back-door channels
(back doors without ports - amazing!!), and the course runs around a professionally constructed VMWare environment with excellent hands on exercises. The exam is a pen test, set up by 7Safe and the University.
There are other unaccredited certifications out there, for example the much maligned CEH. Started by a marketing company in Malaysia, this is a real example of how people attempt to make money out of something they don't fully understand. The company behind it named themselves "EC Council" to make them sound official and have sucked in many companies. They even had the gall to call themselves "New York based" in an attempt to appear American even though the office they registered there has no one in it! For an expose of Sanjay Bavisi's activities, see this hilarious EC Council story. It seems that even though the base course is poor and 'certification' worthless, some providers who sign up to it have basically written their own course and made a good job of it on their own. Other courses also exist, some with good reviews, others not.
So why become certified as an ethical hacker? Well,
the daily rates can be great as a freelance penetration tester,
as well as the fascination/fun element of the role.
Certified ethical hackers such as CSTAs & CSTPs have proven
a level of skill and understanding and this also looks good
on a CV for prospective employers.
Is ethical hacking legal?
I highly recommend these courses and certifications having
taken & passed them as they are very 'hands-on'. My opinions
aside, you should really look at the some of the following
things when considering any ethical hacking training course:
-Penetration testing
-Vulnerability scanning
-The hacker / ethical hacker methodology
-Tools
-Steganography
-Information discovery
-Counteermeasures
-Firewalls
-Web server hacking
-Web user hacking
-Exploiting shares
-Identity spoofing
-Connection laundering
-Hijacking
-Mail spoofing
-Browser security
The 7Safe courses (covering
Windows & Unix) provide a structured methodology for the
techniques used by crackers to assess and attack corporate
networks - the instructor really knew his stuff and (just
as importantly) how to get the message across to us in the
class. They therefore provide valuable insight into how hackers
circumvent security controls in networked environments, applications
and operating systems.
The environment design is
very slick & runs smoothly - and rather than get shown
a lot of stuff, the best thing for me was it that is actually
you doing it, which I found extremely valuable.
|
