Now there is one thing for certain when it comes to ethical hacking, and that is that we are really
never going to be able to operate like a black cat.
Yeah, it's unfortunate.
Even though so many times we're going to be simulating the activities of a black cat.
We can't just do whatever we want.
This is extremely rare.
I suppose one area where we do see this is when we set up a total like test environment.
And this test environment is cut off from our organisation completely.
And in that type of a sandbox we could go ahead and do whatever we wanted.
But notice often times we're going to be working in the context of our organisation and we are going
to be subject to definite limitations and scope.
Before we get there though, I just wanted you to think about what it takes to be an excellent ethical
hacker, and it's certainly going to take your technical skills.
We're going to need to know networking.
We're going to need to know systems, we're going to need to know protocols.
We're going to need to know how to use tools.
We're going to need to know how to interpret those tools.
But remember, there is going to be non-technical skills that are going to prove critical for you as
an ethical hacker.
One of those non-technical skills is going to be your ability to communicate with other team members,
your ability to communicate with superiors, your ability to communicate with end users.
And notice this is often challenging since they to us will seem so technically inadequate.
We all find it difficult to believe that they can be subject to social engineering attacks with such
ease will you know they'll just dumb found us with their ignorance of things.
Cybersecurity.
We need to have incredible patience in that environment to work with them and give them the training
they so desperately need.
Now, once we have the skills that we need to be unethical hacker both those technical and non-technical
skills, we have to know the scope of how we can work.
We need to really, if the organization doesn't have documentation on how we cybersecurity analysts
can conduct our business, we need to help them define that and document that.
A great example might be if we have a bunch of resources inside of a RWC.
Okay, let's say we have a whole bunch of our organization's resources inside of the cloud of IWC.
We need to know that we can penetration test, we can pretend we are attackers, okay?
And that is allowed by IWC against our own resources.
But what IWC will not permit you to do is to penetration test their resources.
So let's say we detect there's an AWB gateway that is giving access to our environment.
They'll let us pass attack traffic through that gateway, but they won't let us attack to that gateway.
Yeah, that's their property.
If we down that gateway it could affect other, you know, tenants that they have that require access
through that gateway.
So we don't get to attack AWB only our own resources in AWB.
Notice how important it is to know these limitations.
And let me just tell you the example I gave of AWB.
That's a.
One I really wanted to give because that environment has changed several times over the years.
It used to be that you could attack basically anything you wanted, but you had to obtain written permission
and you had to give them all the details of the test.
Then it became that you could attack your own stuff only with written permission.
Then it became the current environment of You can attack your own stuff whenever you want.
Don't touch any of the IWC stuff.
You're going to be helping them to divine design and document the limitations and the scope.
If your organisation hasn't already thought about this and have these plans in place, it's always important
as an ethical hacker to make sure you are operating within the scope and limitations that have been
defined.
The last thing we would ever want to do is start engaging in illegal activity when, after all, we
were trying to operate ethically and aboveboard the entire time.