Category

EC-Council in News

CEH at Gobierno de Aragón

INAEM (Instituto Aragonés de Empleo) – EC-Council partner in Spain EC-Council is proud to announce a partnership with El Centro de Tecnologías Avanzadas de Zaragoza, a public training center in Zaragoza, Spain. The center specializes in ICT, with more than 10,000 inscriptions per year and 2,500 students in official ICT Training from the most relevant IT vendors on the market. The results of these trainings are overwhelmingly positive with job placement rates above 85% in six months and satisfaction rates above 9 out of 10 on average. While cybersecurity is a discipline that has been part of many of the center’s programs, with EC Council as a partner, the Certified Ethical Hacker (CEH) and Computer Hacking Forensic Investigator (CHFI) programs will be their first offerings to focus solely on cybersecurity. CEH and CHFI are two of the programs most in-demand on the market, and will help their students find jobs at even higher rates. Students in the two new classes will be capable of identifying, detecting, preventing, and solving the vulnerabilities of different systems and be prepared for a job in cybersecurity. Feedback from students so far has been great: “The thing I liked the most has been the possibility to be in contact with Ethical Hacking specialized professionals. To be able to listen their experiences, advice, and knowledge help in order to apply the course content to the real world. The labs with real examples are really useful too. “ “For me the most valuable thing is the EC-Council certification and the depth and breadth of the content.”

Read article
12 Data Protection Tips for Businesses and Individuals

With cyber-attacks becoming more oriented toward data theft, it is vital for both businesses and individuals to take extra precautionary methods when it comes to data protection. In order to raise awareness about data protection, the Council of Europe initiated the European Data Protection Day in 2007. In 2009, the United States House of Representatives also recognized this day as National Data Privacy Day or Data Protection Day. With 2017 playing host to some of the biggest data breaches, it has become clear that not only are attacks increasing in number (ransomware rising 2,502% in 2017), they are also becoming more potent. Personal data shared on online portals or saved on devices can include home addresses, bank details, social security numbers, passwords, and other sensitive information that can be used by malicious attackers. Here are a few data protection tips to help spread awareness and create a safe cyberspace: Data Protection Tips for Businesses: With new threats emerging and pressure being placed on organizations and businesses by governments through laws like the EU GDPR, it is time for board members, information security executives, and all employees to adopt certain measures to protect personally identifiable information (PII). Update Your Systems and Software: Stay up to date with the latest operating system and additional software updates. Encryption: Encrypt confidential information shared by employees, partners, and customers. Password Creation: Enforce strong password usage, with a regular change in passwords every few months. No External Connections: Avoid using USBs and other external devices on your office system, which can implement the transfer of data from one device to the other. This also includes using USB portals to charge mobile phones and other electronic devices. Data Backup and Recovery: Consult your information security executives to ensure that you have a strong data backup and recovery procedure that is constantly updated. Abide by the Law: Make an effort to find out the requirements of your local legislation and ensure that your technologies and policies are in alignment with them. Data Protection Tips for Individuals: Families and individuals could also fall prey to malicious cyber-attacks like phishing emails, social engineering, and social media threats. A single click on a link sent by a cyber-criminal could lead to loss of sensitive data or identity theft. Here are a few ways to stay cyber safe: Avoid Unknown Links: Never click on unknown links, even if the email sender or website does not look suspicious to you. Create Different Passwords: Use strong and different passwords on your accounts. It is a common practice to use the same password on various accounts, making it easy for a cyber-criminal to gain access to not just one account, but many. Don’t Share or Store PII: Never store your personal information in your email account or share PII via email, messages, or online applications. Read the Fine Print: Always read the fine print before giving out personal information to any website, especially while making online purchases. Avoid Unnecessary Access: Monitor access given to various applications on your mobile phone before installing it onto your device. Online Precautions: Avoid sharing any personal information on social networking platforms, including your location and email addresses. Cybersecurity training programs––like the Certified Secure Computer User (CSCU) program by EC-Council––will help you gain the necessary knowledge and skills to protect your data assets. This course will help you and your organization’s employees learn the skills necessary to avoid and tackle computer and network security threats such as credit card fraud, virus and backdoors, phishing attacks, hacking attacks, and social engineering. Sources: https://www.carbonblack.com/2017/12/20/carbon-black-2017-threat-report-non-malware-attacks-ransomware-continue-spotlight/

Read article
6 Skills Top Companies Look For When Hiring a Chief Networking Officer

Cyber defense has become very important to organizations of all sizes as cyber breaches can lead to reputational damage and massive financial and data losses. Despite updating programs and cybersecurity strategies, organizations are still falling victim to cybercriminals. To ensure the safety of an organization’s assets, companies must hire trained network defenders who will protect, detect, and respond to the many threats facing the modern business. However, getting a job in networking requires technical and soft skill development in various fields. It is accepted throughout the industry that all network defenders must have a comprehensive understanding of network components like Network Interface Card (NIC), switches, routers, and gateways, as well as the networking basics of TCP/IP, but what other ways are there to help you grow in your career? Here are a few skills that will help you score that interview: 1. Security Threat Analysis It is important for a network defender to know what the different types of network security threats are, how they arise, how they affect organizations, and how to prevent them from compromising a network. By analyzing breaches from the past, a network defender will be able to anticipate certain vulnerabilities that the organization might face if preventative measures are not taken. Understanding the methodology and functions of password attacks, man-in-the-middle attacks, privilege escalation, Distributed Denial of Service (DDoS) attacks, and malware attacks like Trojans, ransomware, spyware, and botnets allows the network defender to provide protection to secure an organization’s data assets. Understanding all possible threats to an organization also gives a better idea of what to look for when scanning for vulnerabilities. 2. Networking Controls and Protocols Network defenders understand the importance of network access controls (NAC) solutions and protocols as well as the access control system which includes administrative, technical, and physical controls. 3. Authentication, Authorization, and Encryption Network defenders often work with Internet Service Providers (ISPs) which require safe, usable connections. Using authentication techniques like the two-factor authentication, password authentication, and smart card authentication ensures that data belonging to an individual is not easily compromised by a third individual. Encryption transforms data so that an unauthorized individual cannot read the transferred data without a decryption key. 4. Operating System (OS) Security Protocols Understanding one or more operating systems such as Windows, Linux, or Mac OS is essential for every network defender. Superficial knowledge is not enough when it comes to operating systems. Knowing how to design, install, configure, maintain, and troubleshoot server installations plays a major role when it comes to network defense. 5. Data Backup and Recovery Managing and optimizing the use of servers while implementing data backups to ensure that there is no loss of any important information is an important part of network defense in today’s world. Malware attacks like ransomware often result in the loss of data or a huge financial payout. Proper backup and recovery will help avoid either situation in the case of a breach. 6. Specialty Skills Certain employers demand extra skills like switching and routing, Storage Area Networking (SAN) skills, switches and firewall installation skills, wireless management, Virtual Private Network (VPN) configuration and management, and Intrusion Detection System (IDS) management and configuration. Having knowledge on these subjects will allow you to grow in your career. With the current job growth for networking officers, it is the perfect time to become a network defender. There are many network security courses on the market, one of which is EC-Council’s Certified Network Defender (CND) Certification program. Through the Certified Network Defender (CND) course, students have the opportunity to learn network security technologies and operations and gain hands-on skills that will provide them with expertise applicable in the real world. Learn more about why you should take EC-Council’s course.

Read article
5 Reasons the Certified Network Defender (CND) Certification Is Not an Ordinary Program

Cyber defense has become the focus of smart organizations everywhere as they try to ward off the financial and reputational damage that modern hacks can cause. Cyber breaches have increased 1,370% over the past 10 years despite an industry’s worth of best efforts to stay ahead of cyber criminals. In fact, many organizations are still struggling to implement many of the basics of information security. According to the 2017 Trustwave Global Security Report, it takes an average of 65 days for an organization to detect a breach. Organizations, as a part of their security strategy, should hire certified network engineers who can protect, detect, and respond to threats on their network. Organizations have a better chance at protecting themselves from malicious outsider and insider attacks with the help of a cyber network defender. Stocked with the right set of skills and competencies, a defensive network administrator will be able to give an organization a better chance at protecting themselves. A network administrator plays a vital role in an organization’s cybersecurity as they are the first line of defense against a cyber-attack. Their role revolves around the maintenance of a system’s infrastructure, with an emphasis on networking. They are well acquainted with network components, network topology, security policies, network traffic, network performance, and many more. Testing the network for weaknesses, installing security programs, evaluating the implemented network, and monitoring the network for new updates are just a part of what they do. Through the Certified Network Defender (CND) course, students have the opportunity to learn network security technologies and operations and gain hands-on skills that will provide them with expertise applicable in the real world. The full course comprises the courseware, access to EC-Council’s hands-on iLab environment, 10GB of resources outlining the best practices in network security, assessments, protection tools, and access to many whitepapers. The CND program focuses on: Network security controls Protocols Devices IDS/IPS technologies, tuning, and configurations Performing risk assessments, vulnerability assessments, and scanning and generating subsequent reports Firewall solutions Network topology Many other necessary skills to become a successful certified cyber network defender.

Read article
EC-Council hosted high-profile speakers and attendees at Cloud Con 2017 in Bengaluru, India

Because of the growing adoption and security concerns around cloud technologies, EC Council presented the CLOUD CON 2017 on October 30, 2017 in Bengaluru, India. The conference brought together experts from India and abroad for keynote sessions, panel discussions, and technical presentations on the future and risks associated with cloud innovation and security. With a focus on cloud computing and its potential to transform businesses, Cloud Con 2017 focused on the most pressing security concerns in the wide-spread adoption of cloud technology. Mr. J A Chowdary, IT Advisor and Special Secretary to the Chief Minister, Government of Andhra Pradesh, delivered the opening keynote address which touched on how Andhra Pradesh is aspiring to be the first state in India to move from “Real Time Government to Real Time Governance.” Craig Lim, Head Cloud Security- Asia, Check Point Software Technologies, in his presentation said that “Cloud security should be an enabler, not a hurdle to the adoption of cloud” which was echoed across many other presentations as well throughout the day. Bhavesh Kumar, Head of Engineering & Technology – Data Platform & Analytics, Tesco; lead a panel that covered a mix of areas including IoT and data analytics and their use in a variety of industries including banking, retail, and finance. The panel even spoke about how rural India has been dealing with these challenges. The list of esteemed guests and speakers included luminaries in the cloud security community, including Anshul Srivastav, Chief Information and Digital Officer Union Insurance, UAE; presenting his talk entitled “Reengineer your business with cloud” to a packed room. His presentation was followed by an exemplary session by Winny Patro, Director, APITA, Information Technology, Electronics & communications Department – Government of Andhra Pradesh; speaking about the collaborative ecosystem of cloud computing. Other esteemed speakers included Soo Kiat TEE, Director of Sales Engineering, Asia Pacific & Japan; Gaurav Agarwal, Managing Director, India & SAARC, Symantec; Sudin Baraokar, Head Innovation, State Bank of India; and Suresh Shan, Head of Innovation & Future Technologies, Mahindra Finance. Their talks emphasized the maturity and future of cloud security in India and the global IT industry. The closing panel discussion lead by veteran Sunil Varkey concluded that trust and assurance is the foundation for a sustainable digital economy. Leading cyber security and cloud solution providers like Check Point Software Technologies, Rapid7, Symantec, Qualys, Inc., Fire Compass, Aujas Networks, Grant Thornton India, and The Achilles also partnered with the summit and showcased their latest technologies and solutions to the audience. The end of Cloud Con Summit 2017 also marked the start of the countdown for the second edition of the Fintech Security Summit 2017. The Summit’s theme is “NextGen Cyber Security For Finnovation” and it will be held in Abu Dhabi on December 7, 2017. About EC-Council EC-Council has been the world’s leading information security certification body since the launch of their flagship program, Certified Ethical Hacker (CEH), which created the ethical hacking industry in 2002. Since the launch of CEH, EC-Council has added industry-leading programs to their portfolio to cover all aspects of information security including EC-Council Certified Security Analyst (ECSA), Computer Hacking Forensics Investigator (CHFI), Certified Chief Information Security Officer (CCISO), among others. EC-Council Foundation, the non-profit branch of EC-Council, created Global CyberLympics, the world’s first global hacking competition. EC-Council Foundation also hosts a suite of conferences across the US and around the world including Hacker Halted, Global CISO Forum, TakeDownCon, and CISO Summit. For more information about EC-Council, please see https://staging-new.eccouncil.org.

Read article
EC-Council Lights the Flame of a Cyber Safe Tomorrow with TEK-UP University in Tunisia

Many developing countries have adopted digital technologies, making cyber security a major concern. However, developing countries don’t always have the workforce to effectively protect large infrastructures as technology is rapidly adopted. To counter the threat of a cyber-attack, qualified cybersecurity professionals are more important than ever. Global job predictions suggest the same, as experts predict a shortage of two million cyber security professionals by 2019. Following major cyber threats in the country, Tunisia was one of the first African countries to adopt cyber security as a part of a government sponsored institution in 2004. This partnership gives Tunisia the chance to develop the necessary skills in cybersecurity at the grassroot level, thereby ensuring that cybersecurity skills gain a prominent role in a vulnerable region, while providing TEK-UP a competitive approach over other institutes. Tunisia is an example of a developing country that has strong and well defined cyber laws but the problem of a qualified workforce still exists. EC-Council recently announced a newly formed partnership with TEK-UP University in Tunisia to provide their students with the opportunity to learn ethical hacking – a skill that is fundamental to information security. EC-Council courses will primarily be taught via EC-Council’s online learning solution called iLearn. A TEK-UP university spokesperson stated, “We believe that a partnership with EC-Council will not only help Tunisian students to gain the required skills and to have technical depth, but it will also build a suitable learning environment to brush up on their communication skills, analytical skills, business knowledge, and risk understanding. Acquiring these skills will help students to be ready to face real-world security scenarios in a changing threat landscape and to demonstrate the ability to serve as responders to cybersecurity incidents.” The iLearn platform by EC Council, gives students access to on-demand hands-on training courses. iLearn packages come with one year of access to self-paced streaming video lectures, a certification exam, and access to EC-Council’s online lab platform, iLabs, where students can practice their hacking skills in a safe environment. iLearn – Self-Paced Streaming Video Training iLearn is EC-Council’s self-paced video training option for Certified Ethical Hacker (CEH), Computer Hacking Forensics Investigator (CHFI), EC-Council Certified Security Analyst (ECSA), and the rest of EC-Council’s programs. The range of programs available on iLearn starts from the entry level Certified Secure Computer User (CSCU) course and advances all the way to the courses delivered through the Center for Advanced Security Training (CAST). All courses are taught by expert instructors with experience in training high-level organizations like the US DOD, Pentagon, FBI, NSA, and many more. Learn more about iLearn here: https://iclass.eccouncil.org/learning-options/ About TEK-UP TEK-UP is a Private Higher School of Technologies & Engineering founded in September 2014, in Tunisia. TEK-UP University aims to combine theory with practice, offers education accordingly, and prepares its students for the future through a high-quality learning environment. The university awards National Engineering Diploma in Telecommunications and Computer Science. Education at the University covers specific skills and scientific methods that enables graduates to improve their qualifications. Since its launch in 2014, over 150 technical and linguistic certifications were awarded to its students from potential certification bodies as Cisco, Linux Professional Institute, TEKonsult, Oracle etc. Visit TEK-UP to know more: https://tek-up.de/ About EC-Council EC-Council is the world’s largest Certification body for Information Technology & fastest growing vendor neutral programs. It is the owner and developer of the world famous Certified Ethical Hacker course (CEH), Computer Hacking Forensics Investigator program (CHFI), License Penetration Tester program (LPT), and various other programs. EC-Council Foundation, the non-profit branch of EC-Council, created Global CyberLympics, the world’s first global hacking competition. EC-Council Foundation also hosts a suite of conferences across the US and around the world including Hacker Halted, Global CISO Forum, TakeDownCon, and CISO Summit. For more information about EC-Council, visit https://staging-new.eccouncil.org.

Read article
4 Cybersecurity Threats: Not Just a Tech Problem, but a Business Risk

Cybercrime reaches new heights with the average cost of a single data breach hitting $3.62 million USD, making it crystal clear that technological defenses alone are not enough to protect organizations data assets. Cyber criminals are extremely aware of technology loopholes and are constantly driven by motives such as financial gain, espionage, hacktivism, or, even worse, terrorism. From market manipulation to vandalism, it is evident that these threats have become a business risk for the entire organization and not just a problem for the IT department. According to the Global State of Information Security Survey 2017, less than 45% of board members actively participate in the organization’s security strategy. In fact, the Global Enterprise Security Survey by Fortinet shows that less than 50% of board members treat cybersecurity as a top priority. With organizations and individuals moving toward digitization, more devices require enhanced security measures. Even the growth in artificial intelligence and machine learning is a double-edged sword: while they help create better cybersecurity strategies, they can also be used to enhance tools used for malicious cyberattacks. 1. The Active Involvement of Regulatory Agencies Regulatory agencies like the Federal Trade Commission (FTC) and Securities and Exchange Commission (SEC) have filed lawsuits against companies that have failed to take appropriate steps to safeguard their data. Mishandling data can lead to mistrust among customers, ultimately leading to the downfall of a company. When viewed with that perspective, it’s hard to see cybersecurity as anything but a business risk issue. The fear of reputational damage to an organization is slowly forcing company board members to participate more actively in cybersecurity strategies. Although the complete elimination of cyber risk is impossible, it is important for a company to understand the importance of linking cybersecurity and business strategies. This will enable a company to face problems head-on, make better decisions, and provide customers and employees with better disclosure. 2. Increased Expenditure Does Not Equal Better Cybersecurity Increasing expenditure on security is not the only solution to this problem although doing so is a step in the right direction. In 2014, despite spending $250 million per year on cybersecurity, JPMorgan fell victim to an attack that exposed the confidential data of 76 million households and 7 million small businesses, proving that it takes more than just expenditure to prevent malicious cyberattacks. Board members must confront cybersecurity as a business risk to help increase insider safety and contain outside threats. To be able to treat cybersecurity as a business risk, board members and other leaders in the company should have an understanding of what their digital assets are and how any security policy might affect them. 3. Board Members Must Understand Cybersecurity This also means that company leaders must be knowledgeable enough to ask the right questions when meeting with the CISO and CIO to discuss company security strategies. It is incumbent upon the security leaders of the company to provide business leaders with clear, concise, and accurate reporting to ensure they understand their security posture. Understanding the technical jargon of a CISO might be difficult for those business leaders who have limited knowledge in cybersecurity. It is the joint responsibility of the CISO to work to bridge this gap and speak the language of business and the business leaders’ responsibility to educate themselves on the importance of and basics of cybersecurity. This join approach will help the organization create better cybersecurity strategies and implement better ones in the long run. 4. Conducting Cybersecurity Awareness Training Programs Constant cybersecurity awareness training programs for employees and vendors will also help create a safer cyber environment and control insider threats to a great extent. Security awareness training programs such as EC-Council’s Certified Secure Computer User (CSCU) is specifically designed for today’s computer users who rely on the internet extensively to work, study, and play. This course introduces students to security and teaches them how to secure operating systems, internet safety, social network safety, mobile safety, email safety, and data backup and disaster recovery. Cybersecurity is not just the responsibility of the IT department nor is it the responsibility of the board of directors alone. It requires a collective effort from all levels of an organization in order to develop a cyber safe environment. As a professionals in any area of a company, it is your duty to help create a secure cyberspace by attending and understanding awareness training programs. You can also play a bigger role in the cybersecurity industry with the help of EC-Council – the world’s leading information security certification body since the launch of their flagship program, Certified Ethical Hacker (CEH), which created the ethical hacking industry in 2002. EC-Council Foundation, the nonprofit branch of EC-Council, created Global CyberLympics, the world’s first global hacking competition, in order to spread awareness and encourage more professionals in cybersecurity.

Read article
5 Essential Steps to Improve Your Cybersecurity Strategy

Cybersecurity strategies tend to be stable from year to year, changing only to accommodate budget fluctuations. However, cyber threats change much more rapidly to outsmart things like the anti-virus software and malware prevention techniques of last year. In fact, there are approximately 1.4 million phishing websites that are created every month, resulting in an average loss of half a billion dollars per year. A study conducted by The University of Erlangen-Nuremberg showed that at least 45% of respondents fell victim to a phishing email sent by the college. Through gaining access to a user’s login and password details, cyber criminals can gain control of the victim’s social network, email, and online bank accounts. Despite these realities, organizations still rely on firewalls and threat monitoring as the foundation of their security strategies instead of implementing stronger and more advanced cybersecurity strategies. It is important that an organization’s cybersecurity strategy adapts to the threat landscape, even if this means unlearning a few habits from the past. Here are a few essential steps to follow to create a more efficient cybersecurity strategy: 1. IT and Business Needs Must Align According to the Telstra Cyber Security Report 2017, when asked how important cybersecurity within an organization was, 35.5% of board members said that it was very important, 34.9% thought it was important, 22.4% remained neutral, and the remaining board members rated it low. However, only 16.4% of board members have a very high level of involvement in cybersecurity initiatives of the organization. As the involvement of IT in business expands, there is a greater need for organizations to align their IT objectives with their business goals. With the rise in cybercrime costs around the world, the best enterprise leaders are now recognizing that cyber risks are indeed business risks. What board members might find important may not be a priority to information security professionals and vice-versa. This is why communication between board members and cybersecurity professionals is important for proper security and safety of the company. Cybersecurity awareness and involvement ought to be a top priority for board level members. 2. Continuous Cybersecurity Awareness and Training KPMG’s Cybersecurity Benchmark Report 2017 shows that 28% of all companies in the survey stated that security awareness is the most frequent cybersecurity topic in annual reports. Training is more than just checking a compliance box. When done correctly, it can help organizations align its security practices with its business needs. Despite the advancements in artificial intelligence, humans still play the most important role in maintaining a safe and secure cyberspace. This is why cybersecurity awareness ought to be the most important security role within an organization with a focus on training employees, security personnel, privileged users, third-party vendors, and board members alike. A good cybersecurity training program includes focusing on topics such as: The importance of updated software, backup routines, safe social media practices, and familiarity with phishing emails. Knowing how to handle critical situations. Ensuring that the practices and policies being taught are actually followed. 3. Analyze Where Protection is Required Cybercriminals are working at an extremely aggressive pace, always aiming for the organization’s crown jewels— critical assets and sensitive data. Despite the fact that 80% of breaches in an organization involve stolen or weak credentials, only 40% of those companies  provide adequate protection to privileged accounts. In fact, 80% of the companies do not know where this sensitive data is located or how secure it is. An organization’s critical assets can reside anywhere within the virtual world as employees, customers, and company partners turn to cloud-based technologies to access and share business information. To ensure proper protection, organizations must perform and include explicit risk assessments on critical information assets. This will help them develop appropriate tactics to determine how they can achieve continuity and recovery in the event of a data breach. 4.  Monitor and Update Constantly Most companies are able to identify certain vulnerabilities and are able to patch systems to prevent threats from impacting their operations. However, not all companies ensure that their security training investments are functional, let alone that their disaster recovery plan is appropriate to their needs. Although monitoring threat and vulnerability feeds is important, it may not be enough to protect an organization. To improve a company, one must be willing to address the changing threat landscape head-on. Here are a few steps to follow to ensure an effective overall approach: Implement an inventory that regularly scans assets and quickly identifies vulnerabilities. Adapt a mitigation processes to prioritize and remediate vulnerabilities. Consolidate threat intelligence 5. Protect Beyond Your PII There is at least one malware in every 131 emails sent with approximately 230,000 new malware samples being produced on a daily basis. Most of these malware contained ransomware attacks and although people are well aware of the dangers of clicking on unknown links in an email, 78% of people still admitted to doing so. Ransomware attacks have increased by 36% in 2017 alone and are expected to rise even higher in the years to come. The world of cybercrime has advanced to an era of blackmail. Ransomware has become a major threat to privacy and personally identifiable information (PII) data as criminals not only encrypt the data, but also exfiltrate a copy of data from computer systems and mobile devices for use as blackmail. Criminals then use the information to collect a ransom in periodic installments. It is important for organizations to understand the value of employees’, customers’, and the company’s data and to devise ways to manage, track, monitor, and secure personal data interactions and transactions.

Read article
Global Cyber Security Experts participate in a Panel Discussion moderated by Jay Bavisi, CEO, EC-Council and Chairman of the Board, EC-Council University

The Global Conference on Cyber Space (GCCS) 2017, one of the world’s most prestigious conferences, held this year in New Delhi, India, attracted over 3,000 attendees from across the globe to learn from world leaders in cyber security. Attendees included industry and ministerial delegates and included Indian Prime Minister, the Honorable Narendra Modi, who inaugurated the conference. The GCCS event was held in accordance to his vision to transform India into a digitally empowered country. Prime Minister Modi highlighted the importance of cyber security in his speech, which is one of the key points of the GCCS 2017. “The global community needs to approach the issue of cyber-security with confidence, as much as with resolve. Cyberspace technologies must remain an enabler for our people. The quest for an open and accessible internet often leads to vulnerability.” The event revolved around the theme “Cyber4All” with four sub-themes, Cyber4InclusiveGrowth, Cyber4Digitalinclusion, Cyber4Security, and Cyber4Diplomacy. Mr. Jay Bavisi, CEO, EC-Council Group, and Chairman of the Board, EC-Council University, moderated the panel discussion on the topic “Cyber Behaviour: Best Practices for Netizen”, on November 24, 2017. The panel speakers included: Mrs. Aanchal Gupta, Director, Facebook; Mr. Arvind Gupta, Founder, Digital India Foundation; Dr. C. Mohan, IBM Almaden Research Center; Dr. Dorit Dor, Vice President, Check Point Software Technologies; Prof. Jeanne Holm, Chief Technical Officer, City of Los Angeles; and Mr. Richard David Spearman, Director, Vodafone. When asked to elaborate on the best practices that Facebook follows with regard to cybersecurity, Mrs. Aanchal Gupta discussed how Facebook celebrates Cyber Security Month every October. During October, Facebook security teams try to hack users using phishing e-mails and other attacks to test their employees’ cyber security awareness. The discussion also covered issues like quick ways to determine that technology is used and not abused; various trending and emerging cyber practices for large citizen engagement strategies; and the advancement in technology for a hygienic cyberspace. During the discussion, Jay Bavisi emphasized how “Compulsory cyber education from a very early stage (school level) is crucial as a foundation of cyber hygiene of a country.” About EC-Council EC-Council has been the world’s leading information security certification body since the launch of their flagship program, Certified Ethical Hacker (CEH), which created the ethical hacking industry in 2002. Since the launch of CEH, EC-Council has added industry-leading programs to their portfolio to cover all aspects of information security including EC-Council Certified Security Analyst (ECSA), Computer Hacking Forensics Investigator (CHFI), Certified Chief Information Security Officer (CCISO), among others. EC-Council Foundation, the non-profit branch of EC-Council, created Global CyberLympics, the world’s first global hacking competition. EC-Council Foundation also hosts a suite of conferences across the US and around the world including Hacker Halted, Global CISO Forum, TakeDownCon, and CISO Summit. For more information about EC-Council, please see https://staging-new.eccouncil.org.

Read article
EC-Council CEO, and Chairman of the Board, EC-Council University to Keynote FIRST Technical Colloquium 2017

EC-Council CEO, and Chairman of the Board, EC-Council University, Jay Bavisi, will be presenting the opening keynote at the Forum of Incident Response and Security Teams (FIRST) Technical Colloquium in Las Vegas, NV December 5-6. Jay Bavisi, CEO, EC-Council Group and Chairman of the Board, EC-Council University, will deliver the opening keynote address at the Forum of Incident Response and Security Teams (FIRST) Vegas Technical Colloquium, kicking off on December 5, 2017 at the Venetian Resort in Las Vegas, NV. Bavisi is expected to present on a key issue hindering the information security industry: the lack of testing models and useful certifications that verify real-world penetration testing skills. According to Jay Bavisi, “With the recent Equifax incident and the multitude of other data security breaches in recent years, the need for skilled, vetted penetration testers has increased for the world’s organizations.” However, there is an actual need for the continuous improvement of the measurement and validation of penetration testing skills so that the industry has a reliable pool of capable professionals to help defend their organizations from serious breaches. Bavisi’s talk will touch on the lessons learned from the development of the Licensed Penetration Tester (Master) practical exam by EC-Council in the development of the knowledge, skills, and abilities crucial for penetration testers. The LPT (Master) is the capstone to EC-Council’s certification track and brings together the knowledge and skills taught in other EC-Council programs. While the Certified Ethical Hacker Program (CEH) program teaches students the fundamental knowledge they need, the EC-Council Certified Security Analyst (ECSA) Program requires that candidates demonstrate the skills based on the penetration testing framework methodology. The LPT (Master) exam certifies that an individual has and can apply pen testing skills before being a Licensed Penetration Tester. The LPT (Master) certification is a part of EC-Council’s continuous effort to align the skills of penetration testers to the methods of an advanced attacker. The hands-on exam that students must pass to earn the certification offers a challenging environment previously unseen in the market. The exam simulates the complex network of a multinational organization and requires students to test its security before writing a full report. To successfully pass the LPT (Master), candidates are given 18 hours to demonstrate an advanced understanding of testing modern infrastructures. The exam is broken into three levels and each level amounts to six hours of methodical thinking to overcome three strategically planned challenges. After the completion of each level, a thorough report must be submitted to test professionalism, a skill that every organization requires. Candidates must complete the first level to progress to the next level, while a minimum of five challenges out of nine must be completed to become an LPT (Master). Level 1 focuses on Web Application Exploitation, level 2 on Network Level Exploitations, and level 3 is composed of OS Level Exploitations. Visit www.LPTMaster.com for more details. ABOUT FIRST Technical Colloquia & Symposia FIRST Technical Colloquia & Symposia provide a discussion forum for FIRST members (and non-members) and invited guests to share information about security operations, risk management, governance, legal and regulatory implications, vulnerabilities, incidents, tools, and all other issues that affect cybersecurity and incident response teams. The Las Vegas TC intends to have two major conference tracks running together in parallel. The presentations (including several panels) will cover a variety of subjects and industries. Both advanced and novice members of all cybersecurity and incident response teams are welcome to attend and strongly encouraged to submit presentations. About EC-Council EC-Council has been the world’s leading information security certification body since the launch of their flagship program, Certified Ethical Hacker (CEH), which created the ethical hacking industry in 2002. Since the launch of CEH, EC-Council has added industry-leading programs to their portfolio to cover all aspects of information security including EC-Council Certified Security Analyst (ECSA), Computer Hacking Forensics Investigator (CHFI), Certified Chief Information Security Officer (CCISO), among others. EC-Council Foundation, the non-profit branch of EC-Council, created Global CyberLympics, the world’s first global hacking competition. EC-Council Foundation also hosts a suite of conferences across the US and around the world including Hacker Halted, Global CISO Forum, TakeDownCon, and CISO Summit. For more information about EC-Council, please see https://staging-new.eccouncil.org.

Read article