(I'll withold comment on requiring a cert as a valid 'baseline' of competency as an infosec professional. -rf)
DoD Requires Hacker Certification http://www.informationweek.com/news/government/security/showArticle.jhtml?articleID=223101209 The Department of Defense mandate solidifies the practice of ethical hacking within its ranks of security pros. By Elizabeth Montalbano InformationWeek March 2, 2010 01:31 PM Official government cyber defenders are now required to have the skills of a hacker according to a mandatory certification approved this week by the Department of Defense. The DoD now requires its computer network defenders (CNDs) pass Certified Ethical Hacker certification program from the International Council of E-Commerce Consultants (EC-Council) to fulfill baseline skills. CNDs -- who are part of the DoD's information assurance workforce -- protect, monitor, analyze, detect, and respond to unauthorized activity within DoD information systems and computer networks. Assistant Secretary of Defense John Grimes officially instated the Certified Ethical Hacker requirement in late February under DoD Directive 8570, which provides guidance for how DoD information workers should be trained and managed. The move is significant because it solidifies the practice of ethical hacking -- also known as penetration testing -- in mainstream IT practices, said Jay Bavisi, co/founder and president of EC-Council. The council is a vendor-neutral organization that certifies IT professionals in security-related skills. "Now hacking is no longer a bad word in mainstream IT community," he said, adding that ethical hacking is not exactly what people think of when they hear that word anyway. "What we are doing is not hacking -- we are seeking permission from the owners of the network to beat the hackers at their own game," Bavisi said. In fact, the tag line for the EC-Council's Certified Ethical Hacker educational program is: "To beat a hacker, you must think like one." IBM coined the term "ethical hacking" in the 1960s to define a way for IT security researchers to emulate the work of hackers so they can better defend networks, Bavisi said. Ironically, though ethical hacking was first adopted in covert practices by the U.S. military, in the last decade or so it has become a common practice among Fortune 500 companies to employ ethical hackers to defend networks, he added. The practice seems to have come full circle with the DoD directive, which Bavisi said the department took three years to approve. "We were put through a lot of hoops before the DoD accepted us," he said. "It was a very well-thought, very well-planned, researched movement." _______________________________________________ Infowarrior mailing list [email protected] https://attrition.org/mailman/listinfo/infowarrior
