CREST cancels UK infosec accreditation exams after fresh round of 'cheat sheets' are leaked online
(2020/08/17)
- Reference: 1597684209
- News link: https://www.theregister.co.uk/2020/08/17/crest_halts_infosec_exams/
- Source link:
Exclusive British infosec accreditation body CREST has suspended all of its accreditation exams after The Register revealed a published cache of files including what appeared to be internal exam sheets as well as docs apparently tied to key industry player NCC Group.
We understand from sources that the security body has suspended all of its CREST Certified Infrastructure Tester (known in the industry as CCT INF) and CREST Certified Web Application Tester (CCT APP) exams for up to a month while their contents are reviewed.
An email was sent to CREST members this afternoon and seen by The Register said:
To ensure that the integrity of the CREST Certified Infrastructure Tester (CCT Inf) and CREST Certified Web Application Tester (CCT App) certifications are maintained, these CCT practical examinations will be suspended while the examination content is updated. It is anticipated that this will be complete within the next 3-4 weeks and we will be speaking to those candidates who are scheduled to take examinations in August and September to keep them informed of progress.
The move fuels industry speculation that [1]leaked exam docs contained up-to-date material intended to help candidates pass tests rather than learn and understand the course content. It also lends credence to CREST’s assertions last week that it is [2]investigating the "cheat sheet" GitHub repo scandal, with numerous sources having expressed scepticism to The Register that the investigation would result in meaningful outcomes.
The NCC Group maintains that only some of the files in the repo originated from the organisation.
The news is significant because CCT is regarded as a gold standard accreditation allowing holders to lead testing teams on penetration tests of government and critical national infrastructure systems, under the National Cyber Security Centre’s [3]CHECK scheme .
“All candidates due to take CCT practical examinations this week and next have already been informed. The syllabus will not change,” said CREST.
Industry sources used a variety of colourful words to describe the exam cancellation to El Reg , with all agreeing that this counts as an “ooof” moment for CREST.
An additional cache of documents, titled "CREST" was published on social media over the weekend. Hosted on Dropbox, The Reg understands the files within seemed to contain detailed information about certification exams, as well as emails to and from named people, including what appeared to be senior personnel from within NCC.
The Register has asked NCC Group to comment upon the Dropbox folder’s contents and their implications. The company has previously said it will not be commenting further while it carries out an internal investigation into the exam cheat sheet scandal.
NCC Group CTO Ollie Whitehouse was not available for interview, the firm said. A CREST spokeswoman declined to comment on the exam cancellation at time of publication. ®
Updated to add
After this story was published, a spokesperson for CREST got in touch to say it will take up to three or four weeks to rewrite its exam papers as a result of the leaks:
CREST is aware that further documents were posted online on Saturday 15th August 2020. To ensure that the integrity of the CREST Certified Infrastructure Tester (CCT Inf) and CREST Certified Web Application Tester (CCT App) certifications are maintained, these CCT practical examinations will be suspended while the examination content is updated.
It is anticipated that this will be complete within the next three to four weeks and we will be speaking to those candidates who are scheduled to take examinations in August and September to keep them informed of progress. All candidates due to take CCT practical examinations this week and next have already been informed. The syllabus will not change.
A spokesperson for NCC also let us know the group "won’t comment while the investigation is ongoing."
Get our [4]Tech Resources
[1] https://www.theregister.com/2020/08/11/ncc_group_crest_cheat_sheets/
[2] https://www.theregister.com/2020/08/14/crest_investigates_ncc_group/
[3] https://www.ncsc.gov.uk/information/check-penetration-testing
[4] https://whitepapers.theregister.com/
We understand from sources that the security body has suspended all of its CREST Certified Infrastructure Tester (known in the industry as CCT INF) and CREST Certified Web Application Tester (CCT APP) exams for up to a month while their contents are reviewed.
An email was sent to CREST members this afternoon and seen by The Register said:
To ensure that the integrity of the CREST Certified Infrastructure Tester (CCT Inf) and CREST Certified Web Application Tester (CCT App) certifications are maintained, these CCT practical examinations will be suspended while the examination content is updated. It is anticipated that this will be complete within the next 3-4 weeks and we will be speaking to those candidates who are scheduled to take examinations in August and September to keep them informed of progress.
The move fuels industry speculation that [1]leaked exam docs contained up-to-date material intended to help candidates pass tests rather than learn and understand the course content. It also lends credence to CREST’s assertions last week that it is [2]investigating the "cheat sheet" GitHub repo scandal, with numerous sources having expressed scepticism to The Register that the investigation would result in meaningful outcomes.
The NCC Group maintains that only some of the files in the repo originated from the organisation.
The news is significant because CCT is regarded as a gold standard accreditation allowing holders to lead testing teams on penetration tests of government and critical national infrastructure systems, under the National Cyber Security Centre’s [3]CHECK scheme .
“All candidates due to take CCT practical examinations this week and next have already been informed. The syllabus will not change,” said CREST.
Industry sources used a variety of colourful words to describe the exam cancellation to El Reg , with all agreeing that this counts as an “ooof” moment for CREST.
An additional cache of documents, titled "CREST" was published on social media over the weekend. Hosted on Dropbox, The Reg understands the files within seemed to contain detailed information about certification exams, as well as emails to and from named people, including what appeared to be senior personnel from within NCC.
The Register has asked NCC Group to comment upon the Dropbox folder’s contents and their implications. The company has previously said it will not be commenting further while it carries out an internal investigation into the exam cheat sheet scandal.
NCC Group CTO Ollie Whitehouse was not available for interview, the firm said. A CREST spokeswoman declined to comment on the exam cancellation at time of publication. ®
Updated to add
After this story was published, a spokesperson for CREST got in touch to say it will take up to three or four weeks to rewrite its exam papers as a result of the leaks:
CREST is aware that further documents were posted online on Saturday 15th August 2020. To ensure that the integrity of the CREST Certified Infrastructure Tester (CCT Inf) and CREST Certified Web Application Tester (CCT App) certifications are maintained, these CCT practical examinations will be suspended while the examination content is updated.
It is anticipated that this will be complete within the next three to four weeks and we will be speaking to those candidates who are scheduled to take examinations in August and September to keep them informed of progress. All candidates due to take CCT practical examinations this week and next have already been informed. The syllabus will not change.
A spokesperson for NCC also let us know the group "won’t comment while the investigation is ongoing."
Get our [4]Tech Resources
[1] https://www.theregister.com/2020/08/11/ncc_group_crest_cheat_sheets/
[2] https://www.theregister.com/2020/08/14/crest_investigates_ncc_group/
[3] https://www.ncsc.gov.uk/information/check-penetration-testing
[4] https://whitepapers.theregister.com/
Anonymous Coward
So the other companys now has to wait to get staff qualified while the NCC are allowed to carry on like normal?
Thanks CREST for supporting monopoly in UK!
Weed out the 'script oldies' residents
Anonymous Coward
Not sure what the ultimate decision of CREST is going to be, wait and watch ig.
But if they penalise NCC by ensuring every consultant who has passed CCT/CRT in first attempt to re-sit the new rigs (hopefully not rigged), bet more than 95% of the Manchester staff wont even pass. They are resident pentesters whose only job is to pass CREST (using all the leaked notes) and enjoy all the perks offered by the company on expense of their customers.
Oh Crap!
chivo243
I just found these docs, and I was in the process of osmosis data transfer... another paper cert down the drain I guess.
Ethical?
When are they rebranding to CRUST then?