All right, then Ethical Hacking.
All right.
My first love and forte, offensive
security, ethical hacking and penetration testing.
Not that the defense and the forensics
aren't cool, but this is where you get to exploit systems.
That's just automatically cool.
What is Ethical Hacking?
Ethical hacking is hacking with permission from the owner of the target, number one,
and hacking for defensive purposes only and sharing their findings with the
target, helping them to improve their security posture.
We're doing the same thing that nonethical
hackers do, but we're doing it for defense purposes alone.
Ethical hacking involves use of hacking tools, tricks, and techniques to identify
vulnerabilities and ensure system security.
We're going to follow a hacking cycle.
We're going to also typically repair report.
Now, there's a difference between ethical hacking and pen testing.
In a nutshell, all penetration testers are ethical
hackers, but not all ethical hackers are Penetration Testers.
Penetration Testing is a formalized methodology.
We do incorporate all of the Kang Fu of the hackers, but we do that in an orderly
fashion to produce consistent, repeatable results.
Then we deliver a report and we help to remediate.
It focuses on simulating the techniques
used by attackers to verify the existence of exploitable vulnerabilities and exploit
them, which is different than a vulnerability scam.
Ethical hackers perform security
assessments for an organization with permission.
Absolutely critical.
I'm going to circle that like nine times.
You always have written permission from
the owner before you do anything, period, and you'll never get in any trouble.
However, whatever your intent may be, have written permission.
Otherwise, you're technically a hacker and
an intruder and you can be prosecuted, so don't do it.
All right, scope and limitations of ethical hacking.
The scope is that it is a crucial component of risk assessment, auditing,
counter fraud, and information system security best practices.
Identifying risks,
highlighting remedial actions, and reducing information, communication,
technology costs by resolving those vulnerabilities.
We hack the network before the bad guys do fix the holes,
problem solved, at least for now, and then you find the next vulnerability and the
next vulnerability and it's an ongoing process.
Okay, limitations.
Unless the business is already know what they're looking for and why are they
hiring an outside vendor in the first place?
Chances are they would not benefit much from the experience.
When we walk into an organization and hack the heck out of it and prepare a report
and say, Man, you guys are like Swiss cheese.
That was fun.
They don't do anything about it.
It's not going to do any good.
We're going to recommend remediations.
We're going to coach them through those remediationsand probably do a reassessment
to ensure that those vulnerabilities have been remediated.
The organization needs to understand what
they have to gain, what they're trying to achieve through the testing that helps you
scope the test appropriately on the pen test.
The ethical hacker can only help the organization understand its security.
It's up to them to put the right guards in the network.
We don't fix anything.
We just point out what's broken, we tell
them how to fix, but we don't fix anything.
So as we're going, we don't like, Well, let me go and correct that.
And sometimes you've already got access, you probably could.
But again, that's the purpose of the report and their mediation.