As security breaches continue to grow both in frequency and in the amount of damage they cause (according to Symantec, the average organization incurred $470,000 in losses from endpoint cyber attacks in 2011), penetration testing is becoming increasingly important for organizations of all sizes. For IT professionals seeking to expand their knowledge in that area, the EC-Council’s Certified Ethical Hacker (CEH) credential offers a solid base of expertise.
According to EC-Council senior director Steven Graham, the organization first began offering the credential in 2003. “At that point, there was a gap in education and certification programs training IT security practitioners,” he says. “We saw good coverage in the market for security fundamentals and getting people generally aware of networks … but there was pretty limited availability of programs for people to learn how to truly defend a network.”
The initial idea behind Certified Ethical Hacker, Graham says, was simple – to beat a hacker, you have to think like one. “So the original program was written from the perspective of, ‘What are the steps that a typical hacker would take to break into a network, a government system, or any company?’” he says.
The program is focused primarily on establishing a consistent, methodical approach. “We wanted to baseline the skills and give people the exact phases they need to go through, regardless of what they’re evaluating … so you’re going to start with reconnaissance, you’re going to find everything out about your target that you possibly can,” Graham says. “Once you’ve finished the reconnaissance stage, you’re going to find small weaknesses, and then it’s all about enumeration – if I find one weakness, can I find 100 of the same weakness in that organization? And then they pick their point of entry.”
EC-Council works with authorized partners worldwide to provide training. “We have about 480 training centers in 87 countries … so potential candidates can go anywhere in the world that has an authorized training center,” Graham says. “They can also attend the programs online – we have a series of endorsed partners who’ve created e-learning curricula … and then once they’ve gotten through the training program and had sufficient study time, they can go actually challenge their knowledge at a Pearson VUE or a Prometric testing center.”
A Significant Career Enhancement
Graham says the career impact of getting the credential is often significant. “Last year, we were rated [by Foote Partners] as the second fastest-growing IT security certification as far as salary hikes – and the average starting salary for someone holding the CEH was around $95,000,” he says. “The value of the security individual is typically higher than a network administrator or a network engineer, just because it’s such a specialized skill set.”
And that can make a huge difference when you’re looking for work. “You’ve got so many people out there now that are baseline certified by vendors like Microsoft and Cisco that a security tag or security certification on a title really just rises to the top,” he says. “So we’ve had feedback from a lot of our certified folks that it’s been easy for them when they go out to get a job.”
Ralph Sita is school director and CEO of the Academy of Computer Education (ACE), which provides CEH training in Maryland, Virginia, and Washington, D.C. Like Graham, Sita says the benefits of the CEH credential are enormous. “We’re being told all time, ‘This has meant a promotion,’ or ‘This allowed me to seek another job,’” he says. “It means real monetary value to people – the investment of $3,000 for a CEH class pays itself back three-fold within a year.”
It can also open doors. “Many employers that are in the IT business and are looking to place people are strictly looking for that on a resume – and that alone, in and of itself, is probably worth anywhere from $7,000 to $15,000 on a starting bump when you’re applying for jobs,” Sita says.
Tim Everson, president of Everson Security Consulting, first got the CEH credential soon after its launch, then got recertified a little over a year ago. It’s been a great asset, he says, in getting attention from human resources. “A lot of the HRs know what CEH is … and companies see the value in that,” he says. “They see that you’re proactive about security, you’re somebody who’s security-minded … and so it’s made a big difference, both with my customers, because they value it and see that I’ve got their needs and their security in mind, and also with my employers.”
For anyone who’s considering pursuing the credential, Everson strongly suggests doing classroom training, not self-study. “Research who you’re taking it from, because obviously, it’s based on the quality of the instructor,” he says. “When I took my first one, my instructor was phenomenal … the guy was really hands-on with us in class. We covered the material, but then he would stay after class almost every night and spend more time just working with us and helping us through the hands-on stuff that you don’t necessarily get just from going through the book and materials.”
Terry Cutler, CTO and Certified Ethical Hacker at Digital Locksmiths, says the credibility provided by the CEH credential is also a great benefit. “I’m now a go-to person for the media,” he says. “Any time there’s a breach, I’ll get a call hours later from some local radio or TV station – ‘Tell me how this happened, and how it could have been avoided.’”
Cutler was working at Novell when he first got the credential, and he says he soon became a key advisor for the company on security issues. “I got a call while our guys were at Black Hat,” he says. “They said, ‘Hey, this guy claims to have hacked NetWare, and he’s about to go onstage in two hours – you’ve got figure out how this happened.’ And sure enough, we got it done in an hour and a half. We were able to figure out how he did it. So that training certainly helped – we were able to replicate the problem and capture all the debug information to be able to create a patch.”
After leaving Novell, Cutler says, the CEH credential enabled him to start his own company. “We were able to work with large partners and say, ‘Hey, I bet I can break into your product,’” he says. “Sure enough, we were given chances, and now we’re hacking into pacemakers in the medical industry, and hacking into other tools and products, helping them lock them down before the product ships to a customer.”
There’s one other advantage of the credential that’s worth mentioning, Cutler says – it’s just a great title. “It’s the coolest name on the planet … and it’s a conversation starter,” he says. “On my card, it says ‘Certified Ethical Hacker,’ and [people] will laugh and say, ‘What the hell is this?’ You explain it to them, they say, ‘That’s so interesting!’ – and you get some business from it.”
Jeff Goldman is a freelance journalist based in Los Angeles. He can be reached at jeff@jeffgoldman.com.
