Risk
3/2/2010
01:31 PM
Connect Directly
RSS
E-Mail
50%
50%

DoD Approves Ethical Hacker Certification

Certified Ethical Hacker training and certification is now an option for four categories of IT pros in meeting Department of Defense job requirements.

Editors note: This story was updated on March 9.

Government cyber defenders can now be trained in the techniques of a hacker under a certification program that was recently approved by the Department of Defense.

The DoD requires its computer network defenders (CNDs) to meet certain requirements under Directive 8570, which provides a variety of certification options depending on job description. The newly approved Certified Ethical Hacker certification program, offered by the International Council of E-Commerce Consultants (EC-Council), now fulfills DoD requirements for four categories of CND service providers: analysts, infrastructure support, incident reporters, and auditors. Other certification options are also available to those workers.

The Certified Ethical Hacker qualification tests someone's knowledge in the mindset, tools, and techniques of a hacker. CNDs -- who are part of the DoD's information assurance workforce -- protect, monitor, analyze, detect, and respond to unauthorized activity within DoD information systems and computer networks.

Assistant Secretary of Defense John Grimes officially instated the Certified Ethical Hacker requirement in late February under DoD Directive 8570, which provides guidance for how DoD information workers should be trained and managed.

The move is significant because it solidifies the practice of ethical hacking -- also known as penetration testing -- in mainstream IT practices, said Jay Bavisi, co/founder and president of EC-Council. The council is a vendor-neutral organization that certifies IT professionals in security-related skills.

"Now hacking is no longer a bad word in mainstream IT community," he said, adding that ethical hacking is not exactly what people think of when they hear that word anyway.

"What we are doing is not hacking -- we are seeking permission from the owners of the network to beat the hackers at their own game," Bavisi said. In fact, the tag line for the EC-Council's Certified Ethical Hacker educational program is: "To beat a hacker, you must think like one."

IBM coined the term "ethical hacking" in the 1960s to define a way for IT security researchers to emulate the work of hackers so they can better defend networks, Bavisi said.

Ironically, though ethical hacking was first adopted in covert practices by the U.S. military, in the last decade or so it has become a common practice among Fortune 500 companies to employ ethical hackers to defend networks, he added.

The practice seems to have come full circle with the DoD directive, which Bavisi said the department took three years to approve.

"We were put through a lot of hoops before the DoD accepted us," he said. "It was a very well-thought, very well-planned, researched movement."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.