There is a stigma attached to the word ‘hacking’ and for very good reason. Hacking is associated with the malicious and unauthorised intrusion into a computer or network from an outside party or system with the express aim of stealing, sabotaging, damaging, compromising systems, software or data. As individuals who can undertake such an operation, often without leaving any trace of their identity or origin, hackers are highly experienced and skilled, often with a background in coding and programming.
In this article, we’re going to take a look at the area of cyber security known as ethical hacking (also referred to as penetration testing), what ethical hackers do and exactly when and why hacking can ever be ethical.
When is Hacking Ethical?
Hacking becomes ethical when its purpose is to identify the risks and vulnerabilities of a given system or network to outside attack. By attempting to bypass a system’s security measures, ethical hackers can expose inherent flaws and then deploy effective countermeasures and fixes to improve the system’s overall cyber security. For this reason, ethical hackers must be able to put themselves into the shoes of a would-be cybercriminal or cyber terrorist in order to best try to outwit the target system’s security.
Because ethical hackers use the same techniques as malicious hackers, many are often themselves reformed hackers, who have been headhunted by security agencies or the IT security departments of large companies. In this sense, ethical hacking is inherently the same as malicious hacking in its methodology and practice. Crucially though the end goal is one of exposure and not exploitation.
How does an Ethical Hacker help improve Cyber Security?
An ethical hacker’s first task is to seek to understand and learn how a system operates and its underlying cyber security measures. They will then research and meticulously document their attempts at bypassing that system’s security, before discussing their findings with those responsible for designing the IT security infrastructure, as well as senior management. The results of the investigations are then used by the organisation to fix any backdoors or vulnerabilities in their system. They will then work closely with the teams responsible for implementing these fixes, often to re-test them and identify any remaining vulnerabilities or unintended consequences.
In creating their methods and investigations, an ethical thinker must penetrate a system from a hacker’s perspective. While doing so, they must also keep in the back of their mind the real-world consequences of the possible cyber security attacks. ‘What would an attacker do? Bypass first-level security? Make illegal wire transfers? Steal customer information? How can the system not only prevent but quickly identify and recover from such malicious attacks?’
The ethical hacker must perform his hacking through an open process where managers and the IT team collaboratively know their system’s vulnerable points and how to counteract high-skilled malicious attacks.
Information security, the industry where ethical hacking belongs to, is still young and developing. There is a significant lack of knowledge of what ethical hacking is and what its results should include. Because of that, the roles, responsibilities, and tasks of an ethical hacker can vary greatly from day to day.
How to become an Ethical Hacker
The job market for ethical hackers continues to grow, along with the cases of cybercrime that organisations are subjected to. It can go by the titles of Information Security Analyst, Security Consultant, or simply Ethical Hacker. In the UK the average annual salary of an ethical hacker / penetration tester is £37,442.
Whilst there are no mandatory qualifications for becoming an ethical hacker, successful candidates will have a strong background in coding and programming and several years’ experience working in IT or IT security.
For those wishing to pursue a career in penetration testing, it is recommended that a foundation course in IT security like the CompTIA Security+ and Network+ qualification, ISO27001 Foundation courses. For those with experience in IT security, the Certified Ethical Hacker course is very relevant but more general cyber security courses can lead to a role in penetration testing such as the Certified Information Systems Security Professional (CISSP). You may then consider specialising in ethical hacking by obtaining a more advanced certification such as the OSCP or Kali Certified Penetration Tester qualification.
One of the most important factors to become a good ethical hacker is to learn how a hacker thinks. Hacking is not all about technical knowledge. It involves tactical and strategic thinking, problem solving and a certain degree of creativity. As controversial as it might be to say it, the reason that some of the best ethical hackers in the world are former cybercriminals is that they have more experience than most of thinking like a criminal.
It’s likely if you’re reading this though that you don’t have a background in cybercrime and if that’s the case, then one way to demonstrate your propensity for penetration testing is to build your own testing environment in which you can practice and document your results. This will also help you learn in a simulated real world environment, giving you the vital experience that it is very hard to learn in a classroom.