How can you find a Certified Ethical Hacker?

Certifications are a great way to demonstrate your knowledge and skills. But, how do you know which certifications you should be pursuing, and what certifications are good for what?rnWhat follows is a shortlist of the most common ethical hacking certifications: CISSP (CISA), CCNP (CCNA), CISM, CCIE, CISSP-RISP, CISSP-RISP2.rnWhile this list is by no means exhaustive it does cover the majority of the top certs out there. It also accounts for many of the industry’s most popular certifications as well — including security training courses like Black Hat and Black Hat Briefings.rnA couple of notes: one, I would recommend doing a little research before choosing your certification so that you can make informed decisions; two, some certs may be more appropriate for certain kinds of projects than others; and three, some certs may not be worth pursuing.rnFor starters on finding certified ethical hackers: they seem to be pretty easily available and relatively inexpensive (for a good reason). The best part is that they require very little work and don’t even require any coding experience or ability — just an assurance that you will follow all proper security best practices if and when dealing with sensitive information. rnWhat are the risks of not hiring a Certified Ethical Hacker? rnThe term “Hire a Hacker” Certified Ethical Hacker(CEH) is a bit of a misnomer. As with many ethical hacking skills, the term is something that needs to be taken with a grain of salt (at least until an actual CEH certification program comes along).rnThe best and most established CEH certification programs are focused on theoretical knowledge and skills, and while they are useful they are not the same thing as actual CEH credentials.rnWhat you need to know is that there are two kinds of CEH certifications: those based on theoretical knowledge and those based on practical skills. The former tends to have better reputations — but there are some clear downsides as it tries to define its experience: if you don’t have any practical experience, you can’t really earn a good reputation.rnThe latter tends to be more accurate: if your practical experience doesn’t come from working on real-world projects, then it will generally have greater credibility since it has been tested in the real world. On average, the “practical experience” section will contain more details about specific techniques than the theoretical part. This means that you can usually get away with cherry-picking some of the best parts of different tests or techniques and applying them to your projects without being too obvious; but if you want to go all-in, this will become more important than ever as you scale up.rnIn short: keep in mind that every aspect of your job should be evaluated carefully before hiring someone else for it; and that only some parts need to be verified by actual hands-on experience before taking on additional responsibilities and becoming certified. rnHow much does a Certified Ethical Hacker cost? rnYou’ve probably heard of ethical hacking by now. It is an industry that does not get enough attention, and a big part of the reason for this is that it’s not sexy. Hiring the lowest bidder in an auction is a good way to do it if you have a building sealed off from the outside world and don’t mind your employees being exposed to them (and their tools). There are many ethical hacking services out there, but they all have some kind of hidden cost or hidden pressure on them (such as having to pay for their software licenses).rnSo here’s what we suggest:rn1. Don’t look at the price tag on your competitor's list — even if it sounds like “free,” check out their terms and conditions first (especially if you are not familiar with ethical hacking) and make sure that any additional costs over what you would pay in-house aren’t going to impact your ability to pay.rn2. There are a few companies that offer ethical hacking services that actually do more than just checking if your server supports SSL encryption or something similar (for example, Sentry Labs offers full-time staff focused on core development skills; Blue Coat offers support for free). These may be too expensive for you — or they may provide valuable services that are worth paying extra for. So check out what they offer first before committing money.rn3. Also make sure any additional things they charge you aren’t going to impact how much money you are able to spend on your overall project budget:rn4. If this isn’t clear yet, don’t pay people based on how many SANS certifications they have:rn5. If this isn't clear yet, don't pay people based on how much money they make off of their business.