Hello everyone, I recently posted a large rant about higher education, cyber security degrees, and expectations. On that post a lot of people have asked me about certifications, career paths, etc. One topic I want to address really badly is EC-Council and the C|EH certification. I see a lot of people talk about it on here and it is seemingly recommended a lot and that makes me really sad and here is why.
EC-Council is a security training and certification organization that has been around since 2001, their C|EH (Certified Ethical Hacker) certification has been around since 2003. This is probably their most notable certification and I think a lot of people seem to believe it is a golden ticket into Infosec. The problem is that it’s not and it’s actually a terrible certification written by a very shady company. If I can save one more student or cyber security enthusiast from wasting time and money on a certification that will not advance their career – this post will be worth it.
* Per EC-Counils own site the C|EH is a ‘core’ certification yet they charge $1200 for a single voucher. To put this in perspective the CISSP (which is an expensive certification) costs $730. The CCNP is $400 and neither of these are considered ‘core’ certifications. I’ve read and taught a few versions (no longer do) of the C|EH and it’s depth is about on par with the Security+ (which is a good cert) and a fraction of the price at like $200. The C|EH price is really not in the same universe as most other certifications.
* It is a certification that claims to give students hands-on experience in the wonderful world of ethical hacking but the exam itself is a 125 question multiple choice test. For $1200 I would expect a live lab environment and hands-on scenarios but alas bust out your note cards and get to memorizing tool names in Kali linux because in reality that’s what most of the questions are based on – tools and methodologies.
* EC-Council got caught, and admitted to plagiarism. Their heart felt apology is on their own website. As you can imagine – they’re very very sorry.
* EC-Council got hacked on multiple occasions, in-fact so badly so that their website was used to spread malware to its users for several days. Along with this lots of user PII was leaked including passports, and other forms of ID for verifying people sitting for certification exams. For a company based around cybersecurity and training our DoD it kind of rubs me the wrong way that they were compromised this badly. However, I will kind of give them a partial pass because being a cybersecurity organization can make you a bigger target in many cases.
* Their sales tactics are some of the worst I’ve ever seen. They nonstop call educators, corporations, or anyone who they think may want to peddle their products. It’s the equivalent of used car salesman but for a really bad certification. If this certification is so good, why do you need to call my cell phone multiple times a week to try and lock me into deals. Good educations and certifications kind of sell themselves.
* Lastly, the name and it’s marketing. In my humble opinion the only reason the C|EH is still relevant is because of the marketing behind it’s name. It’s a cool name, it has a good ring and the certification has been around for a long time. Most of the jobs and people I see asking for it are HR or non-technical managers. I personally know three engineers that have it and one of them doesn’t even put it on his resume. The other two told me it was a waste and they only got it because their company had a group training session for it.
* Now lastly the salaries, this one is really dumb because people often times Google salaries of certifications and those can be wildly inaccurate. For example my Network+ is still active because I’m an educator and I get CEUs like crazy. I also have a Bachelors degree, 10 years of experience, and a CISSP. This is a similar story for the C|EH. Most of the people I know who have the C|EH also have the CISSP, CCNA, Bachelors, some Masters, and lots of years of Infosec experience.
So please lets all avoid EC-Council, save ourselves a ton of money, and let horrible companies like them disappear or re-invent themselves. There are so many better alternatives so hear me out and check out what’s below. Also keep in mind I don’t work for any of these companies and I even have had some criticism of a few of them in the past. Overall, I still think these are all solid and quality offerings.
* eLearnSecurity: eJPT, eCPPT
* OffensiveSecurity: OSCP
* Cisco: CCNA CyberOps
* CompTIA: Security+, PenTest+, CySA+, CASP
* (ISC)2: SSCP, CISSP