10 Hottest IT Certifications

IT certifications have always been popular among IT pros to bag the right job or seek the right jump. With the economy back in green, IT jobs too are back. And with them the demand for IT certifications, which in recent times have become more vendor- and technology-specific.

So, what are the IT certifications that will keep IT pros in demand or are useful for job/career opportunities going forward.

Technology research firm Foote Partners recently shared IT certifications that could be considered “hot” in the coming months (these unranked certifications are a part of the company’s upcoming quarterly index on hot skills and certifications).

Here’s over to the top 10 hottest IT certifications from the list.

VMware Certified Professional (VCP)

With virtualization technology becoming hot, it is little surprising that VMware Certified Professional (VCP) programme is in demand. Research shows that enterprises often face lack of required expertise specific to virtualization.

According to Forrester Consulting, proper skills for virtualisation-specific projects are difficult to attain and retain.

Certified Information Systems Auditor (CISA)

Certified Information Systems Auditor (CISA) is a professional certification for Information technology audit professionals sponsored by the Information Systems Audit and Control Association (ISACA). Candidates for the certification must meet requirements set by ISACA.

The CISA certification is for pros seeking jobs in areas of IT auditing, security, and control. CISA tests are conducted once a year, in locations spread worldwide.

Five years of verifiable experience in IS auditing, control or security is required to take the exam.

GIAC Security Audit Essentials (GSAE)

GIAC Security Audit Essentials or GSAE is for pros planning to enter the information security industry who are tasked with auditing organization policy, procedure, risk, or policy conformance.

Certified Information Security Manager (CISM)

Certified Information Security Manager or CISM is a certification for information security managers awarded by the Information Systems Audit and Control Association (ISACA).

To apply for the certification, an individual must have at least five years of information security experience with a minimum three years of information security management work experience in particular fields.

The certification aims to provide a common body of knowledge for information security management and includes material on broader issues such as how to govern information security as well as on practical issues such as developing and managing an information security programme as well as incidents.

Check Point Certified Security Expert (CCSE)

Designed for experienced security professionals, Check Point Certified Security Expert or CCSE certification is claimed to be one of the most respected vendor-specific security certification.

CCSE is an advanced Core security certification built on CCSA NGX, confirming in-depth skills and expertise in managing and supporting Check Point products.

Proficiencies include configuring and managing VPN/FireWall as an Internet security solution and virtual private network (VPN), using encryption technologies to implement site-to-site and remote access VPNs, and configuring content security by enabling Java blocking and anti-virus checking.

Check Point Certified Security Administrator (CCSA)

Another Check Point-specific certification, Check Point Certified Security Administrator or CCSA aims to validate a security administrator’s ability to maintain day-to-day operation of vendor’s security solutions and ensure secure access to information across the network.

Proficiencies include creating and installing security policies, using logging and reporting features, and managing anti-spoofing, Network Address Translation (NAT), and OPSEC applications.

Microsoft Certified Systems Engineer (Security)

Microsoft Certified Systems Engineer (MCSE) certification provides an individual skills in designing, implementing, and administering infrastructure for business solutions based on Windows Server 2003 and Microsoft Windows 2000 Server.

Implementation responsibilities include installing, configuring and troubleshooting network systems.

To be certified on newer Microsoft technologies, such as Exchange Server 2010, Windows Server 2008, or SQL Server 2008, a prospective candidate should pursue the Microsoft Certified IT Professional (MCITP) certification. In case a student has done the MCSE on Windows Server 2003 certification, he can upgrade to the Microsoft Certified Technology Specialist (MCTS) and Microsoft Certified IT Professional (MCITP) on Windows Server 2008 certifications.

Certified Wireless Security Professional (CWSP)

Certified Wireless Security Professional (CWSP) is claimed to be an advanced level certification that measures the ability to secure any wireless network.

A wide range of security topics focusing on the 802.11 wireless LAN technology are covered in the coursework and exam, which is vendor neutral.

The CWSP certification is awarded to candidates who pass the CWSP exam and who also hold the CWNA certification. The CWNA certification is a prerequisite to taking the CWSP exam. The certification covers a range of security areas including detecting attacks, wireless analysis, policy, monitoring and solutions.

GIAC Certified Intrusion Analyst (GCIA)

GIAC Certified Intrusion Analyst (GCIA) is an information security certification entity that specialises in technical and practical certification as well as new research in the form of its GIAC Gold program. SANS Institute founded the certification in 1999.

GIAC provides vendor-neutral computer security certifications linked to the training courses provided by the SANS.

Cisco Certified Network Professional (CCNP)

Another vendor specific certification, Cisco Certified Network Professional or CCNP aims to validate the ability to plan, implement, verify and troubleshoot local and wide-area enterprise networks and work collaboratively with specialists on advanced security, voice, wireless and video solutions.

To apply for CCNP certification a candidate must have at least one year of networking experience. The CCPN tests are conducted by Pearson VUE.

There are five levels of certification: Entry, Associate, Professional, Expert, and Architect, as well as seven different paths, Routing & Switching, Design, Network Security, Service Provider, Storage Networking, Voice, and Wireless.

Now, software that can hire, pay employees

An Australian website is using software algorithms that allow computers to automatically recruit, hire and pay employees to do a wide range of tasks. Freelancer.com normally provides a forum for companies wanting to outsource their work, reports New Scientist.

For example, a program written for a store with a large inventory could automatically recruit salespeople to sell its products and send more work the way of people that do the best job. “Software can now simply post a job and hire one, three, or 500 humans; software can now literally assemble an army overnight to solve complex problems,” says Matt Barrie, Freelancer.com’s CEO.

As the software is doing the commissioning and assessing the results, it avoids the need for a company to hire other people to rate the work that was done. Barrie said that there are enough programmers on the site’s books for it to be possible to write software that can even improve itself, by recruiting people to improve its own code.

Govt. to develop software to control cyber attacks

After growing worries over the cyber attacks on the Indian establishments, the government has planned to develop its own software and end the dependence on foreign operating systems and anti virus products. The government has formed a high level team to develop the plan for building software.

According to a report by Harsimran Singh and Thomas Philip of Economic Times, the panel will suggest different ways to conduct third-party audits on existing software in government offices to prevent online sabotage attempts until the software’s launch.

Followed by the cyber attacks by China based hackers, the Defence Ministry raised concerns over use of anti-virus products of foreign vendors and hence the government acted actively by forming a task force to get over with the problem. Hackers from Pakistan and terrorist organizations too have stepped up attacks on Indian websites in recent years. The taskforce is expected to submit its recommendations by June.

A technical head of a U.S. based network security firm said that it is very much in favour of the government to devise its own software for the operations. The person also added that it will give it the independence of customizing it according to its needs.

India is now making a late scramble to join nations that own both hardware and software technology critical for the safe upkeep of their defence, space and nuclear programmes. The government recently sanctioned Rs. 50 crore to design an indigenous microprocessor.

The government’s unease with foreign technology and hardware has been on the rise in recent years. Recently, it warned telcos against installation of foreign gear. Last week, Junior Minister for Communications & Information Technology Sachin Pilot told the Rajya Sabha about several measures the government has taken to detect and prevent cyber attacks.

No sensitive information will be stored on systems connected to the internet, while ministries and departments have been told to carry out regular IT systems audits. The government has also established a Crisis Management Plan against cyber attacks to be implemented by all central ministries, state governments and critical sectors, he said.

Last week, US counter terrorism head in the Clinton and Bush regimes, Richard Clarke, warned nations of an ‘electronic Pearl Harbour’ that can shut down power, transportation, communication and all money from banks and exchanges. He said a massive cyber attack could paralyse the U.S. in 15 minutes.

The defence ministry has already removed many of its computers off the internet. Its officers can’t carry pen drives inside offices. The government has also decided to connect all key government ministries and offices, which number over 5,000, to an alternate exclusive communication network that is being built for the armed forces. This will provide a secure backup during emergencies, or at times when the networks of private telecom operators cannot be used to transmit sensitive information.

State-owned BSNL and MTNL are building the Rs 10,000-crore, 40,000 km alternate-fibre network. The armed forces will shift a bulk of their communication needs to this network, thereby enabling them to vacate huge chunks of radio frequencies or spectrum they occupy for commercial telephony.

Globally, most operating systems and anti-virus software are linked via the internet. This ensures that as soon as security loopholes are found in browsers, operating systems or a product software, companies start installing and updating them online.

But glitches can still occur. Last week, US-based McAfee, the world’s second-largest anti-virus software maker, sent an update that started to recognise a genuine file as fake. This resulted in millions of computers getting shut down by themselves. The errors were rectified later.

New malware can bypass any anti-virus protection

A new malware is so effective that it can bypass protections provided by anti-virus products like those offered by McAfee, Trend Micro, AVG, and BitDefender, according to researchers.

A method developed by software security researchers at matousec.com, works the same way an antivirus app functions, by hooking directly into Windows and masquerading as harmless software. It tricks Windows by sending sample code to the OS, like any antivirus app that looks completely caring, and then at the last microsecond it swaps in malicious code, which is then executed.

If an anti-virus application uses the traditional method of interacting with Windows-a system called SSDT-then it will be vulnerable to attack via this method. most of the anti-virus products use SSDT. The researchers have noted during their investigation that “100 percent of the tested products were found vulnerable.” It didn’t matter if the user had administrator rights or not, the exploit was able to sneak through. Researchers have claimed that they have performed tests with most of today’s Windows desktop security products.

The exploit has to be timed just right so the benign code isn’t switched too soon or too late. But for systems running on multicore processors, matousec’s “argument-switch” attack is fairly reliable because one thread is often unable to keep track of other simultaneously running threads. As a result, the vast majority of malware protection offered for Windows PCs can be tricked into allowing malicious code that under normal conditions would be blocked.

The researchers listed 34 products that they said were susceptible to the attack, but the list was limited by the amount of time they had for testing. “Otherwise, the list would be endless,” they said.
The technique works even when Windows is running under an account with limited privileges.

The exploit has some limitations. It requires a large amount of code to be loaded onto the targeted machine, making it impractical for shellcode-based attacks or attacks that rely on speed and stealth. It can also be carried out only when an attacker already has the ability to run a binary on the targeted PC.

H D Moore, CSO and Chief Architect of the Metasploit project, told The Register, “A malware developer abuses this race condition to bypass the system call hooks, allowing the malware to install itself and remove McAfee. In that case, all of the ‘protection’ offered by the product is basically moot.”

The good news is that the attack is not completely realistic, since the size of the code required would have to be large to work. A quickie download wouldn’t be possible, so the attack would likely have to find its way onto a target computer by other means. But that also worries researchers, since commonly downloaded software could be intentionally infected with the malware

Right now the attack is primarily theoretical and hasn’t sprung up in the real world, so there’s no need to panic. Antivirus software companies have yet to respond to the threat, and it may take some time for them to do so.