Advanced GIAC Certifications
Currently, SANS offers one advanced-level certification— the GIAC Certified Forensic Analyst (GCFA) and is developing another—the GIAC Security Engineer (GSE). Both certifications may be described as follows:
- GIAC Certified Forensic Analyst (GCFA). This certification identifies security professionals with advanced knowledge of system forensics, investigations, and response. The associated course first covers the basics of forensic auditing, file system structures, and MAC times, and then moves to advanced incident response and forensic topics, Windows and Unix tools, and legal issues. Students gain real-world experience by inspecting and exploring a compromised system from the Honeynet Project. Because of the advanced nature of this certification, SANS highly recommends that candidates have experience or knowledge equivalent to the GCIA, GCIH, GCWN, or GCUX.
- GIAC Security Engineer (GSE). Obtaining five of the intermediate-level certifications (Firewall Analyst, Intrusion Analyst, Incident Handler, Windows Security Administrator, and Unix Security Administrator) works like a "merit badge" in that candidates then become eligible to sit for the GSE certification. At this writing, the GSE certification is under development. It should be available some time in 2003.
Table 1 summarizes the various SANS-GIAC certifications.
Table 1 SANS-GIAC Security Certifications
Level |
Initials |
Expansion |
Requirements |
Foundational |
GGSC-0100 |
GIAC Gold Standard Certificate |
Exam, project |
|
GISO-Basic |
GIAC Information Security Officer-Basic |
Exam, project |
|
GSAE |
GIAC IT Security Audit Essentials |
Exam, project |
|
GSEC |
GIAC Security Essentials Certification |
Exam, project |
|
GSLC |
GIAC Security Leadership Certificate |
Exam, project |
Intermediate |
GCFW |
GIAC Certified Firewall Analyst |
Firewalls exam, project |
|
GCFA |
GIAC Certified Forensic Analyst |
Exam, project |
|
GCIH |
GIAC Certified Incident Handler |
Incident exam, project |
|
GCIA |
GIAC Certified Intrusion Analyst |
Intrusion exam, project |
|
GCUX |
GIAC Certified Unix Security Administrator |
Unix exam, project |
|
GCWN |
GIAC Certified Windows Security Administrator |
Windows exam, project |
Advanced |
GSE* |
GIAC Security Engineer |
GCFW, GCIA, GCIH, GCWN, GCUX, exam, project |
|
GSNA |
GIAC Systems and Network Auditor |
Exam, project |
*This certification is under development.
Remember, to obtain any GIAC certification, candidates must submit a practical project for each topic for which they seek certification and must also take one or more required exams. Presently, some exams and projects may not be submitted without taking the courses, which cost from around $1,560 to $2,450. SANS does, however, offer Challenge exams for a limited number of certifications. Candidates can forgo taking the class and pay $250 to $425 per exam to obtain certification.