What is Ethical Hacking?
What is 'Ethical Hacking'?
Ethical hacking is an authorized attempt to get unauthorized access to computer systems or data. In other words ethical hacking tries to identify security flaws in computer systems or networks by attempting to exploit vulnerabilities and breaking the security measures implemented.
Why Ethical Hacking?
Information is more valuable in the world today and organizations has to deal with large amounts of sensitive data everyday. Cyber criminals tend to focus more on organizational sensitive data so that stronger and updated security needs to be maintained to prevent attacks from malicious hackers. Organizations need to take proactive actions to ensure that no chances are given for attackers to expoit any security vulnerability in their systems or networks that cause trouble to the organization. Ethical hacking helps with proactively identifing and eliminating cyber security vulnerabilites of organizations so that attackers cannot harm the systems or the sensitive information.
Four key protocols of ethical hacking
Following are 4 key concepts followed in ethical hacking
- Have proper legal approval and security assessment
- Define scope such that hacking remains legal and within organizations boundries
- Respect data sensitivity
- Report all discovered vulnerabilities and provide recommendations
 |
| Ethical hacking is an authorized attempt to exploit security vulnerabilities |
Who are 'Ethical Hackers/White Hat Hackers'?
They are refered to good or ethical type of hackers who involves in ethical hacking with the prior approval of organizations to improve security of organizations by proactively identifing vulnerabolities and providing recomendations for improvements.
Ethical hackers:
- Do not access systems with the intension of mallicious attacks or any personal gains like black hat hackers.
- Use their knowledge to improve security of organization's systems and data.
- Often performs re-testing with the consent of the organization to ensure that vulnerabilities are removed
How Ethical Hacking Works?
Ethical hacking aims to discover any threats or securoty vulnerabilities that can be exploted by a malicious attacker. Ethical hackers collect information and look for attack vectors aginst the target assets to identify vulnerabilities. They donot just stop identifying the vulnerability but also exploits it to prove how a malicious attacker colud explot that vulnerability.
An ethical hacker may often seek answers for questions like:
- What are the vulnerabilites present?
- How many vulnerabilities are visible to attackers?
- What information or part of system is most significant for attackers?
- What part of the system may attackers want to access?
- How can an identified security vulnerability be exploited?
- What would the attacker do with any information acquired from the organization?
- How to fix the identifed vulnerability?
An ethical hacker uses different stratergies to penetrate systems in similar ways as a malicious hacker.Following are a few such stratergies used to exploit different vulnerabilies in systems and networks in ethical hacking.
- Port scanning: Scanning ports to identify ports that are open in systems using port scanning tools and take measures to remove any vulnerability identified.
- Try to bipass intrusion detection systems, firewalls and honeypots.
- Check patch updates and ensure no security exploitations are possible.
- Attempt to bipass or crack encryptions of login credentials.
- Network sniffing and attempt hijacking of web applications and servers.
- Social engineering technics like dumpster diving(trash bins,notes,docs)
Some common security vulnerabilities like injection attacks, broken authentication, sensitive data exposure, security misconfigurations can be identified through ethical hacking.
How to become an Ethical Hacker?
In order to become an ethical hacker strong knowledge in wide range of computer and network technologies is essential. Following are some skills to be developed and certificates to be followed in ordre to become an ethical hacker.
Skills:
- A thorough knowledge in networking and programming
- Proficiency in different operating systems
- Expertise in scripiting languages
- Solid understanding of principles of information security
Certificates:
- Certified Ethical Hacker(CEH) Certification
- Offensive Security Certified professional(OSCP) Certificate
- Cisco's CCNA Certification
- Global Infomation Assurance Certification Penetratio Tester Certification
 |
| Some certificates needed for becoming an ethical hacker |
References:
[1] https://Ethical hacking, www.synopsys.com/glossary/what-is-ethical-hacking.html
[2] https://blog.logsign.com/what-is-ethical-hacking/
[3] https://www.varonis.com/blog/white-hat-hacker/
[4] https://sucuri.net/guides/owasp-top-10-security-vulnerabilities-2020/
[5] https://www.simplilearn.com/roles-of-ethical-hacker-article
Good article Dilesha. Keep up the good work!!!
ReplyDeleteCan you explain more about the difference between ethical hacker and penetration tester?
Thank you Suranga.
DeleteFor your question I would like to say that ethical hacking and penetration testing are quite closely going areas with a little difference between them.
Ethical hacking focuses on finding overall security vulnerabilities in organization’s systems while penetration testing focuses more on a specific target environment like organization’s security systems. So an ethical hacker needs more time, knowledge and expertise compared to a penetration tester and needs to do lot of reporting about the findings and suggested solutions. An ethical hacker would use different technics from scanning networks upto social engineering. A penetration tester's work would consume relatively less time and needs less reporting.
You can refer the article in the following link for more details on this.
https://blog.learningpeople.com/ethical-hacking-vs-penetration-testing
Informative article!! keep it up.
ReplyDeleteThank you Osura.
DeleteNice write-up. Can you explain about what type of problems an ethical hacker can address?
ReplyDeleteThank you Dulanga.
DeleteEthical hackers try to identifying vulnerabilities of an organization's systems or data and to detemine necessary steps to ensure security of them. So an ethical hacker can find many security vulnerabilities including security misconfigerations of systems and services, broken authentications, injection attacks, malicious components installed, possibilities of social engineering attacks etc. They often carry out security scans to identify network vulnerabilities, misconfigured firewalls or perimeter devices and other vulnerabilities that can lead to sensitive data exposures. Ethical hackers try to figure out these vulnerabiliites in organizations, try to exploit them and suggest solutions mitigate those vulnerabilities.
The following article is about some famous incidents that ethical hackers figured out vulnerabilities in systems.
https://securityboulevard.com/2019/09/10-times-ethical-hackers-spotted-a-software-vulnerability-and-averted-a-crisis/
With the increasing rate of cyber attacks in the world the role of ethical hackers has become very important for organizations. This article gives a good explanation about ethical hacking. Nice work
ReplyDeleteThank you Santhoopa!!
DeleteI also agree that ethical hacking plays an important role in IT security of modern organizaitons.
A very informative article. It is fascinating to see how ethical hacking is evolved to meet the requirements of the data security. You have well explained
ReplyDeleteThank you!!
Delete