[Infowarrior] - DoD Requires Hacker Certification

[Richard Forno]

(I'll withold comment on requiring a cert as a valid 'baseline' of  
competency as an infosec professional.  -rf)

DoD Requires Hacker Certification

http://www.informationweek.com/news/government/security/showArticle.jhtml?articleID=223101209

The Department of Defense mandate solidifies the practice of ethical  
hacking within its ranks of security pros.

By Elizabeth Montalbano
InformationWeek
March 2, 2010 01:31 PM

Official government cyber defenders are now required to have the  
skills of a hacker according to a mandatory certification approved  
this week by the Department of Defense.
The DoD now requires its computer network defenders (CNDs) pass  
Certified Ethical Hacker certification program from the International  
Council of E-Commerce Consultants (EC-Council) to fulfill baseline  
skills.

CNDs -- who are part of the DoD's information assurance workforce --  
protect, monitor, analyze, detect, and respond to unauthorized  
activity within DoD information systems and computer networks.

Assistant Secretary of Defense John Grimes officially instated the  
Certified Ethical Hacker requirement in late February under DoD  
Directive 8570, which provides guidance for how DoD information  
workers should be trained and managed.

The move is significant because it solidifies the practice of ethical  
hacking -- also known as penetration testing -- in mainstream IT  
practices, said Jay Bavisi, co/founder and president of EC-Council.  
The council is a vendor-neutral organization that certifies IT  
professionals in security-related skills.

"Now hacking is no longer a bad word in mainstream IT community," he  
said, adding that ethical hacking is not exactly what people think of  
when they hear that word anyway.

"What we are doing is not hacking -- we are seeking permission from  
the owners of the network to beat the hackers at their own game,"  
Bavisi said. In fact, the tag line for the EC-Council's Certified  
Ethical Hacker educational program is: "To beat a hacker, you must  
think like one."

IBM coined the term "ethical hacking" in the 1960s to define a way for  
IT security researchers to emulate the work of hackers so they can  
better defend networks, Bavisi said.

Ironically, though ethical hacking was first adopted in covert  
practices by the U.S. military, in the last decade or so it has become  
a common practice among Fortune 500 companies to employ ethical  
hackers to defend networks, he added.

The practice seems to have come full circle with the DoD directive,  
which Bavisi said the department took three years to approve.

"We were put through a lot of hoops before the DoD accepted us," he  
said. "It was a very well-thought, very well-planned, researched  
movement."