FAQ: How to Become a Certified Ethical Hacker

The Certified Ethical Hacker (CEH) credential is administered by the International Council of Electronic Commerce Consultants (EC-Council), a member-supported certification body for IT and cybersecurity professionals. In order to become a CEH, information security professionals must pass the 125-question EC-Council Certified Ethical Hacker exam. The EC-Council extends eligibility to sit for the exam to individuals who have at least two years of experience working in information security or a related field, and to those who have completed a CEH training course offered by the EC-Council. While there are no formal educational requirements for CEH certification, successful candidates for certification typically have a strong background in computer programming, computer science, software engineering, mathematics, and/or information security, which may include a bachelor’s and/or a master’s degree in computer science, IT management/security, cybersecurity, or a related field.

What Is Ethical Hacking?

Ethical hacking involves deploying many of the same tools that malicious hackers use to identify weaknesses in computer networks and systems and to address those vulnerabilities. Ethical hackers learn how to think like a cyber attacker and utilize hacking techniques to preempt actual attacks and improve the security of an organization’s digital infrastructure. There are many different formal designations for IT security and cybersecurity professionals who specialize in ethical hacking, including penetration tester/penetration test engineer, security architect, systems engineer, cybersecurity analyst, and computer network vulnerability analyst. The primary function of those who specialize in ethical hacking is to improve IT systems security by subjecting those systems to the types of attacks that might be launched by malicious hackers, determining specific vulnerabilities, and working with other IT security professionals to strengthen overall system security.

Skills and Training for Ethical Hackers

Ethical hacking requires a broad range of technical skills and practical experience in the realm of IT systems administration and cybersecurity. As a foundation for ethical hacking, experts recommend a strong working knowledge of Windows, Linux, and other common operating systems, familiarity with TCP/IP protocols, and an aptitude for using common programming and scripting languages like C, C++, Java, and Python. Ethical hackers must also have knowledge of data storage systems, SQL programming, and the design of computer networks. In addition, ethical hackers learn how to utilize various cybersecurity tools, including encryption protocols, firewalls, and debugging software, and study various types of hacks, such as viruses, worms, denial-of-service (DOS) attacks, server hijacking, network scanning, and phishing. Finally, ethical hackers may be called upon to reverse engineer various hacks in order to use those techniques to perform penetration tests and other diagnostic procedures on an organization’s IT infrastructure.

While ethical hacking is not specifically taught a the college and university level, there are bachelor’s and master’s degree programs in cybersecurity, information security, information assurance, IT systems management, and digital forensics that can provide academic training in many of the skills used by ethical hackers. Studying computer science, computer programming, and/or computer engineering at the associate, bachelor’s, and master’s degree level can also provide a solid foundation for work in the field of penetration testing and ethical hacking.

There are other ways to develop ethical hacking proficiencies, which can include military training programs, tutorials offered by professional organizations and private companies, and learning hacking skills on one’s own. However, as the field of cybersecurity has become more professionalized, it has become common for employers to hire candidates who posses formal training in information security and ethical hacking.

The CEH Certification

The CEH certification is a professional credential for ethical hackers. It is administered by the EC-Council, an organization that offers 20 certifications in the field of cybersecurity. Candidates for CEH certification are required to pass a 125-question, multiple-choice exam that takes four hours and tests for knowledge in five key areas: network reconnaissance, network access, network enumeration, maintaining network access, and disguising evidence of a network breach. There is a non-refundable $100 application fee to take the exam, and candidates for certification must either complete an EC-Council training course in ethical hacking or have at least two years of professional experience in information security or a related field.

The EC-Council’s training program for ethical hackers is a five-day class that introduces students to over 340 attack technologies and over 2200 tools commonly used by hackers in the real world. It costs $850, which includes the $100 exam application fee. The EC-Council’s CEH program is accredited by the American National Standards Institute (ANSI) and adheres to guidelines for cybersecurity training outlined in the National Institute for Cybersecurity Education’s Cybersecurity Workforce Framework (NICE Framework).

Preparing to Become a CEH

Early and foundational preparation for becoming a CEH can, as previously noted, take many forms. As bachelor’s and master’s programs in cybersecurity have proliferated, earning a degree in cybersecurity or a related field like digital forensics has become a more standardized pathway to eventual CEH certification. However, earning a degree in computer science, computer programming, or computer engineering can also provide a good foundation for eventual certification. It is also common for CEH candidates to learn about information security protocols, system administration, and network architecture, and cultivate practical skills for ethical hacking through work in tech support, computer programming, and/or network security. Finally, in addition to the EC-Council’s CEH prep course, there are numerous organizations and private institutes that offer seminars and training programs in penetration testing, computer programming, information security, and other aspects of ethical hacking.

Steps to Becoming a CEH

1. Earn a bachelor’s or a master’s degree in cybersecurity, digital forensics, computer science, or another related IT field, and learn how to program, operate database systems, and utilize information security technologies.
2. Enter the IT workforce and gain experience in overseeing network administration, managing security protocols, and analyzing systems architecture.
3. Enroll in an EC-Council’s Certified Ethical Hacker training program.
4. Take the EC-Council’s CEH exam and receive a passing score.

Additional Resources and Certifications for Ethical Hackers

The EC-Council website provides resources on CEH certification, preparing for the CEH exam, and the field of ethical hacking. The organization also recently introduced a second certification for ethical hackers, the CEH (Practical) certification. The CEH (Practical) credential is available to CEH’s who are able to pass a six-hour exam that presents candidates with 20 hacking challenges. In addition, there are several other advanced certification programs administered by the EC-Council that have applications in the field of ethical hacking. These include:

• Certified Network Defender (CND)
• Certified Security Analyst (ECSA)
• Advanced Penetration Testing (APT)
• Licensed Penetration Tester (LPT-Master)
• Certified Network Defense Architect (CNDA)

The non-profit Council of Registered Security Testers (CREST) has three training programs for penetration tester certifications:

• Certified Security Testing Associate (CSTA)
• Certified Security Testing Professional (CSTP)
• Certified Penetration Tester (CPT)

The SANS Institute, a private information security training and certification organization, offers several certification programs for penetration testers through its Global Information Security Certification (GIAC) program. These include:

• GIAC Penetration Tester (GPEN)
• GIAC Web Application Penetration Tester (GWAPT)
• GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)

Offensive Security is another private company that provides training and certifications for penetration testers, including:

• Offensive Security Certified Professional (OSCP)
• Offensive Security Certified Expert (OSCE)
• Offensive Security Exploitation Expert (OSEE)
• Offensive Security Web Expert (OSWE)

More Cybersecurity FAQs: