Security.com

ethical hacker

By Garry Kranz

What is an ethical hacker?

An ethical hacker, also referred to as a white hat hacker, is an information security (infosec) expert who penetrates a computer system, network, application or other computing resource on behalf of its owners -- and with their authorization. Organizations call on ethical hackers to uncover potential security vulnerabilities that malicious hackers could exploit.

The purpose of ethical hacking is to evaluate the security of and identify vulnerabilities in target systems, networks or system infrastructure. The process entails finding and then attempting to exploit vulnerabilities to determine whether unauthorized access or other malicious activities are possible.

Origins of ethical hacking

Former IBM executive John Patrick is often credited with creating the ethical hacking term in the 1990s, although the concept and its applied practice occurred much earlier.

The term hacking first started to appear in the 1960s in connection with activities at the Massachusetts Institute of Technology and referred to applying creative engineering techniques to "hack" machinery and make it operate more efficiently. At the time, hacking was considered to be a compliment for those with exceptional skills in computer programming.

Malicious hacking became more frequent in later decades, in parallel with the commercialization of consumer-oriented computer technologies. Hackers realized computer programming languages could be used to manipulate telecommunications systems and complete long-distance calls for free, a practice dubbed phreaking.

The 1983 film War Games, in which a student inadvertently cracks into a war-game supercomputer run by the U.S. military, helped to highlight the vulnerabilities of large computing systems. In the 2000s, compliance regulations, such as the Health Insurance Portability and Accountability Act, that govern the storage and security of digitized medical and business data have elevated the role of ethical hackers within the realm of cybersecurity.

The commercialization of hacking skills, known as hacking as a service (HaaS), has made cybersecurity more complex. On the positive side, cybersecurity firms and information technology (IT) security vendors have started to offer optional ethical HaaS via contract to corporate clients. However, an underground market is flourishing on the dark web, including online marketplaces for aspiring hackers, often in the pursuit of illegal activities.

The coronavirus pandemic created new avenues of pursuit for cybercriminals. In "The Hidden Costs of Cybercrime," published in July 2020 by the Center for Strategic and International Studies and security software company McAfee, monetary losses from cybercrime in 2020 are estimated to top $945 billion. In addition, the report estimated that organizations will spend $145 billion on cybersecurity services and technologies.

What is ethical hacking?

An ethical hacker needs deep technical expertise in infosec to recognize potential attack vectors that threaten business and operational data. People employed as ethical hackers typically demonstrate applied knowledge gained through recognized industry certifications or university computer science degree programs and through practical experience working with security systems.

Ethical hackers generally find security exposures in insecure system configurations, known and unknown hardware or software vulnerabilities, and operational weaknesses in process or technical countermeasures. Potential security threats of malicious hacking include distributed denial-of-service attacks in which multiple computer systems are compromised and redirected to attack a specific target, which can include any resource on the computing network.

An ethical hacker is given wide latitude by an organization to legitimately and repeatedly attempt to breach its computing infrastructure. This involves exploiting known attack vectors to test the resiliency of an organization's infosec posture.

Ethical hackers use many of the same methods and techniques to test IT security measures, as do their unethical counterparts, or black hat hackers. However, rather than taking advantage of vulnerabilities for personal gain, ethical hackers document threat intelligence to help organizations remediate network security through stronger infosec policies, procedures and technologies.

Any organization that has a network connected to the internet or that provides an online service should consider subjecting its operating environment to penetration testing (pen testing) conducted by ethical hackers.

What do ethical hackers do?

Ethical hackers can help organizations in a number of ways, including the following:

Ethical hacking vs. penetration testing

Pen testing and ethical hacking are often used as interchangeable terms, but there is some nuance that distinguishes the two roles. Many organizations will use both ethical hackers and pen testers to bolster IT security.

Ethical hackers routinely test IT systems looking for flaws and to stay abreast of ransomware or emerging computer viruses. Their work often entails pen tests as part of an overall IT security assessment.

Pen testers seeks to accomplish many of the same goals, but their work is often conducted on a defined schedule. Pen testing is also more narrowly focused on specific aspects of a network, rather than on ongoing overall security.

For example, the person performing the pen testing may have limited access only to the systems that are subject to testing and only for the duration of the testing.

security audits vs. vulnerability assessments vs. pen testingTesting is essential to the role of the ethical hacker.

Ethical hacking techniques

Ethical hackers generally use the same hacking skills that malicious actors use to attack enterprises. They use a form of reverse-engineering to imagine scenarios that could compromise business and operational data. The varied techniques and tools are part of an overall vulnerability assessment the ethical hacker performs on a client's behalf.

Some of these hacking techniques include the following:

Ethical hackers also rely on social engineering techniques to manipulate end users and obtain information about an organization's computing environment. Like black hat hackers, ethical hackers rummage through postings on social media or GitHub, engage employees in phishing attacks through email or texting, or roam through premises with a clipboard to exploit vulnerabilities in physical security. However, there are social engineering techniques that ethical hackers should not use, such as making physical threats to employees or other types of attempts to extort access or information.

How to become an ethical hacker

There are no standard education criteria for an ethical hacker, so an organization can set its own requirements for that position. Those interested in pursuing a career as an ethical hacker should consider a bachelor's or master's degree in infosec, computer science or even mathematics as a strong foundation.

Individuals not planning to attend college can consider pursing an infosec career in the military. Many organizations consider a military background a plus for infosec hiring, and some organizations are required to hire individuals with security clearances.

Other technical subjects -- including programming, scripting, networking and hardware engineering -- can help those pursuing a career as ethical hackers by offering a fundamental understanding of the underlying technologies that form the systems they will be working on. Other pertinent technical skills include system administration and software development.

Certified ethical hackers

There are a number of ethical hacking certifications and related IT security certifications that help ethical hackers demonstrate their subject matter expertise. Industry certifications include the following:

Careers for ethical hackers

In addition to industry certifications, many U.S. universities and colleges offer curricula for learning the basics of becoming an ethical hacker. As a job description, the U.S. Bureau of Labor Statistics (BLS) lumps ethical hacking into the broader category of infosec analyst.

According to BLS statistics, 131,000 people work in infosec analysis. The annual median salary is $103,590, or $49.80 per hour. BLS predicted 41,000 new infosec analyst jobs will be created by 2029, a growth rate of 31% that is much faster than the overall U.S. average.

Different types of hackers

Hacking is not always clear-cut. A gray hat hacker may expose a security exploit and publicize the findings but may not alert the system owner to take action. Gray hat hackers can provide valuable assessments of security vulnerabilities, although some also may trade this information for personal gain.

Green hat hackers are generally aspiring hackers who lack the technical acumen but display aptitude and interest in learning how to successfully hack computer machinery. Green hat hackers may include people involved in hacktivism and cyber espionage.

Blue hat hackers comprise two different types of hackers. The first type is a person skilled enough with malware to compromise computer systems, usually as a form of retaliation for perceived or real slights. Learning the trade is not a priority for this type of individual. The second type refers to someone asked to participate in Microsoft's invitation-only BlueHat security conference. Microsoft used ethical hackers to execute beta testing on unreleased products, looking for deficiencies in infosec in early software versions.

Red hat hackers are ethical hackers who specialize in cracking Linux-based systems. But, rather than turning black hats over to authorities, red hats execute a form of reverse-hacking measures to cripple the compute resources of a black hat.

TechTarget is responding to readers' concerns as well as profound cultural changes. In some cases, we are defaulting to industry standards that may be seen as linguistically biased in instances where we have not found a replacement term. However, we are actively seeking out and giving preference to terms that properly convey meaning and intent without the potential to perpetuate negative stereotypes.

21 May 2021

All Rights Reserved, Copyright 2000 - 2024, TechTarget | Read our Privacy Statement