|
|
|||||||||||
|
|||||||||||
|
|
TOP STORIESCalling all hackers21 February 2008If you’ve got the hacking skills of Neo from The Matrix, financial firms want to hear from you. SocGen, unsurprisingly, is among those looking over its shoulder for any potential abuse of its IT systems following the £3.5bn hit from Jérôme Kerviel’s alleged fraud.
As a reaction, the firm has set up a dedicated department and hired a team of internal hackers to test the integrity of its risk controls. ABN AMRO also employs a team of ‘ethical’ hackers to perform similar checks.
Mark Bown, information security consultant at 7safe, reckons banks are realising the need for constant vigilance: “Penetration testing has traditionally been conducted by consultants, on an annual basis which typically only targets high-value systems. Actually having hackers in-house is still relatively uncommon, but banks are beginning to see it as very valuable and are taking specialists on.”
The Financial Services Authority also warned in its 2008 Financial Risk Outlook that there was a need for heightened security, as it anticipated a rise in fraudulent trading.
But what do these ethical hackers actually do? Bown says a lot of the attacks are essentially testing the business logic of the system, and trying to trick the software into doing something dodgy the programmers simply hadn’t anticipated. The job of the hackers is to stay one step ahead.
Ethical hackers' pay generally comes in at around the £50k mark, but similar roles in investment banks, such as information security analysts, can draw in £60-80k.
Rob Rowlands, account manager at recruiters Church International, reckons talent is relatively thin on the ground: “You’d be hard pushed to find someone with experience of a banking environment and the necessary skills who wasn’t being well looked after at the moment.”
IBM says the ideal candidate for ethical hacking training would have “successfully published research papers or released popular open-source security software”.
However, the traditional qualification is CSTP or the CISSP, and the University of Glamorgan now offers an Msc in Computer Forensics.
What about hackers making the move from the dark side? 7safe says it would never consider a reformed hacker, and that it performs rigorous background checks on any candidates looking to embark on the CSTP.
|
|
|||||||||
|
|
|||||||||||