A security accreditation scheme such as Crest is definitely a good idea (Ethical hackers face new test, 22 March). But it needs to go further than Check, the public sector equivalent.
The Check system was not especially relevant to non-government organisations, apart from giving them a general sense of trustworthiness. Even that had little practical effect because most clients would want contracts or non-disclosure agreements signed regardless.
It would be good if Crest could provide more specific certification. For example, someone who is a great web application tester could be certified specifically in that area and would not necessarily be certified for database security or firewall security testing.
This would give clients the reassurance that the people doing the work have the right level of specialist knowledge.
Rory McCune