Do you want to be an ‘Ethical Hacker’? What certifications do you need, what jobs are available and how much is the salary?
A few years back, I remember working with a client who worked in the Networking Security space, who specifically worked with high-security military defence systems. They had a requirement for what they described as a ‘really hot computer whizz kid who had the skills to hack any system”. The job description was tweaked just a little bit! Naturally, the numbers that came forward were not as many as anticipated for fear it was a false job and entrapment. Those that did come forward couldn’t believe that there was a real employment opportunity for them to sit there all day and try to break a system and get paid or it. 15 years on, these jobs are very much there and the term ‘ethical hacker’ is not a job title per se, Penetration tester is a title far more common.
The terms White Hat Hacker and Black Hat Hacker are titles used to describe the difference between those on the good side of the law, and those on the wrong side of the law.
So, what are the differences between White Hat and Black Hat hackers?
Black Hat Vs White Hat
Black Hat Hackers have malicious intent. Their purpose is one of either theft, DDOS attacks, vandalism of systems or writing destructive programs such as worms. The classic definition of a hacker is: a computer user who wilfully vandalizes or commits theft on other people’s networks. These are the criminals that you picture when you hear the word ‘hacker’.
White Hat Hackers are ‘hackers’ are actually doing good. These are computer security experts who are employed by companies putting their Cyber skills to good use testing systems security and finding faults and weaknesses. It’s not surprising to hear that sometimes, these White Hat Hackers may have been a Black Hat hacker in a previous life. Of course, there are those who have never been on the wrong side of the law and have learned to become a White Hat hacker with study and experience.
Is this something that is appealing to you? Do you want to break systems, try and open up encrypted files and gain access to businesses, all legally? What are the skills you’ll need? Experience looked for, and what types of jobs and salary can you expect?
What Qualifications and training do you need?
When researching what experts are advising, it seems “a vast amount of technical knowledge of IT systems and software and, in particular, how to exploit their vulnerabilities”. Also, to have a degree or master’s in information security, computer science or even mathematics provides a strong foundation but is not essential to have. Naturally, undertaking any IT Security course is of great benefit too.
The kinds of skills you need are having a solid understanding of computer networking LAN/WAN, VPN, MPLS, routing protocols etc. Learning Languages such as SQL, C++, C#, Visual Basics, .net, Perl, Python, Java etc will also help your understanding. Understanding inbuilt operating system features of Windows, Mac, Linux, etc and configuring manageable network appliances like routers, switches, firewalls, etc are all skills and experience required.
Not forgetting that alongside technical skills, consultancy skills are needed too. You will need to be able to articulate your findings to colleagues, managers, and sometimes to a board level, as you’ll be providing consultancy and recommendations to customers as to how vulnerabilities can be addressed. There are formal qualifications available to take alongside your experience and education.
The most common certificate is the EC-Council Certified Ethical Hacker certificate. This is a self-study or classroom taught course, that ends in a 200 multiple choice question at the end exam. Communication- Electronics Security Group (CESG), which is now part of the National Cyber Security Centre, approval is also required for any ‘Penetration test’ on a company and this is appointed by a government department.
This involves the CHECK scheme, which enables penetration testing by NCSC approved companies, employing penetration testing personnel qualified to assess IT systems for HMG and other public sector bodies. As a Penetration Tester, you must prove yourself through practical examinations under lab conditions. You can become qualified as a team member or a Test Team Lead. Whenever a government department is going through penetration testing, it is a requirement that with the tester, there is also a Team Lead present.
CREST Schemes is another path you can take. CREST provides internationally recognised accreditation for organisations and individuals providing penetration testing, cyber incident response and threat intelligence services. As a member of CREST, it is compulsory for companies to undergo regular and stringent assessments; while CREST qualified individuals have to pass rigorous examinations to demonstrate knowledge, skill and competence. CREST is governed by an elected Executive of experienced security professionals who also promote and develop awareness, ethics and standards within the cyber security market.
Tiger Scheme is a commercial certification scheme for technical security specialists, backed by University standards and covers. Tiger scheme offers two levels of qualification: Qualified (CHECK Team member equivalent) and Senior (CHECK Team Leader equivalent). You have the option of taking an entry-level certificate becoming a testing team member and like the CREST scheme, you also have the option to become a Team Leader. With these schemes, for the entry-level certifications, it is advised that you have at least 2 years work experience and research in these areas. For the more senior level certifications, 5 years’ experience is advised.
Can you be turned from the Dark Side? Can Cyber Criminals become Ethical Hackers?
In short, the answer is yes. If you have a talent and skill and you enjoy what you’re doing, then why not turn in to a profession that you can get paid for and put your skills to good use. There are many ‘ex’ ‘Black Hat hackers’ who have seen the ‘light’ and switched hats. Some even founding their own businesses offering security consultancy.
However, high standards held at CREST and such places can make it difficult for companies who do employ such individuals to become members and some Security experts think that a track record as a recreational hacker simply shows errors in judgement and a willingness to put self-interest first. Trust can be an issue, with the thought of, ‘how can I be sure you won’t revert back to your previous way of thinking?’
What kinds of Ethical Hacker job roles are available?
Actual job roles in the field are listed in many different forms. The most commonly-advertised jobs are generally for ‘Penetration Testers’, but many similar roles are often labelled as ‘Security Analysts’, ‘Information Security Consultants’, ‘Network Security Specialists’ and similar.
Occasionally you may find these roles referred to as ‘Red Team’ roles. Many organisations that practise this form, divide their security staff into ‘red teams’ and ‘blue teams’. Red teams assume the role of attackers, trying to compromise the network and the blue team, try to keep the business’ systems safe.
What can I earn as an ‘Ethical Hacker’?
How much can you expect to earn and just how buoyant is the job market? Someone entering the market can expect in the region of £25,000. A registered level professional would expect to earn in the region of £55,000 and a team leader could be looking at £90,000-plus.
A penetration tester working as a contractor can easily earn between £400-£500 a day. As for market buoyancy, it seems that the demand for high-quality individuals working for professional companies far exceeds supply and currently, the UK is seen as one of the leaders in this area.
There have been so many recent reports of huge organisations having their systems hacked and data leaked, all types of malicious attacks are taking place more frequently. The reality is that now cybersecurity is much higher on every organisation’s executive agenda, it has been said that to pursue a career in this field has never been better.
How to apply for a job as an Ethical Hacker
Who should you approach if you want to get started in the penetration testing field?
Contacting CREST is a good place to start. They will provide advice and guidance on the best way to enter and then progress in the industry.
The Cyber Security Challenge UK is another good starting point to get an understanding of the cyberlearning opportunities and careers within the industry.