Hacking seen from the point of view of IT security, allies or dangerous practices?
When we hear the term “hacking” we probably associate it with theft or a malicious action. However, there are benign applications for these actions, since there are people who use these skills for good, usually ethical hacking applies to organizations, since they handle a set of data that tends to have a high value, either monetary or informational. Most organizations have a security policy that employees must follow to protect the security of the company’s data, however, malicious hackers are constantly looking for ways to illegally penetrate the company’s platforms and thus cause all kinds of havoc. Therefore, in these cases, the actions of ethical hackers come to the fore. We will now take a look at these practices in organizations.
What is an ethical hacker?
It consists of an inspection carried out by information security professionals, commonly known as “pentesters”. These inspections or audits are known as “ethical hacking” or “penetration tests”. The job of ethical hackers is to try to penetrate an organization’s systems to look for vulnerabilities and based on this, combat them or correct them to prevent malicious hackers from entering. Penetration testing was first performed due to the appearance of attacks on organizations that represented significant monetary and reputation losses. Over time, ethical hacking has become more popular due to the development and appearance of new malicious intrusion techniques that threaten information security, and therefore, it is these good hacking practices that have become a safe option for organizations. However, ethical hacking has been a subject of controversy as there are different positions both for and against these practices, due to the same stigma attached to hackers and hacking itself.
Based on this, we can establish a difference between ethical and malicious hackers. As we have seen, not all hackers are criminals; some simply use their skills to help strengthen security in organizations. Over time, other terms were introduced to differentiate these hackers. Those who identify themselves as criminals, whose actions are directed towards malicious or lucrative ends can be called “crackers”, while those who contribute an asset and help strengthen security in organizations are known as “ethical hackers”.
Other classifications for these hackers are “Black and White hat”. Black hats fall into the same category as the malicious hackers or crackers described above, they tend to have great power and are difficult to detect and catch, their skills can go as far as penetrating bank accounts, government platforms, among others. While white hat hackers are the allies of organizations and usually only focus on scanning vulnerabilities for reporting and later correction.
What are the roles of ethical hackers?
The main function performed by white hat hackers is penetration testing, which is intended to analyze the vulnerabilities presented by the company’s systems, and from this create reports with a correction strategy and thus increase the security of the information. During these penetration tests, certain areas are evaluated and then defined:
- Physical security: refers to the security tests that are carried out in a physical environment. It integrates the tangible elements that make up the security that require a physical effort, in these are:
- Monitoring review
- Perimeter review
- Access control review
- Review of the environment and location
- Communications security: this includes telecommunications and data networks. Telecommunications include all networks in their category, whether digital or analog, while data networks are all systems, both electronic and networks where the interaction requires an established wiring system.
- Wireless security: includes all virtual communications, signals and detachments that are produced electromagnetically. The tasks of the ethical hacker in this area are:
- Verification of wireless network
- Verification of wireless mobile devices
- RFID verification
- Verification of wireless surveillance devices
- Verification of wireless input devices
- Internet security: in this area the penetration tests are directed to the web applications, normally these tests are made without knowing the internal operation of the application, this way the vulnerabilities are found. The areas of verification to be executed by the ethical hacker are:
- Hosting controls
- Network survey
- Search for competitive information
- Testing of online applications
- Privacy Review
- Testing of contingency measures
- Password decryption
- Access Control
- Evaluation of security policies
- Security of information storage: this includes the resources used for the proper storage of information.
- Process security: in this area, social engineering is applied to evaluate access by employees. Usually employees participate involuntarily, ie without knowledge that they are participating in a test, in this case are used to evaluate the penetration through the media used, either phone, e-mail, chat, among others.
Advantages and disadvantages of implementing ethical hacking.
- The main advantage of penetration testing through the use of ethical hackers is that you can know the different vulnerabilities that your organization presents and from this you can implement a solution to better protect the information.
- Ethical hacking is a controlled practice, i.e. it is carried out with the company’s consent, so the hacker’s tasks can be verified and monitored to ensure the veracity of their results.
- The hackers used for these tasks are professionals in the IT or computer area and can be found in the information technology and communication department.
- The solutions to the vulnerabilities found by the ethical hacker involve a series of processes and introduction of departments that can make the process more complex within the organization.
- Normally, the implementation of White Hackers is done as a defense and not as a prevention, meaning that organizations tend to seek this resource after an attack or threat has been found. Therefore, it is recommended that you implement this technique as a preventive measure and do so periodically.
- This practice tends to be subject to much controversy or stigmatization by organizations, so many do not take into account the true usefulness of this practice. Therefore, it is important to understand that it is a safe and ethical practice that will help the safety of your organization.