Cyber world, the virtual world on the internet is now a part of our daily life. Every person, who use internet either by computer or by any other gadgets, is a part of the cyber world. But Cyber world is also full of thieves as real world. So security is must. If you do proper security for all your physical things in real world, you must be aware of the security of the things you have in cyber world. If you think, you are not a computer person and why should you need to know about cyber crimes and its protections, and then just think about your bank account which you use and your credit cards and your online purchase. All these things are the main target of hacker which you use daily in your life.
Cyber crimes
All the organizations and companies have a network of systems for storing and accessing their private information which are confidential. These data is the top secret part of the company. But hackers always try to break the security of these systems to get that secret information of the company. According to the latest cyber crime report by Symantec, cyber crime costs more that $114 billion annually. This is a huge loss by cyber crimes. The report also says that 14 adults become the victim of cyber crimes in a minute. You can imagine the dangers. Most of the hackers work individual and hack only for their profit. But there are many companies who hire hackers to know the hidden secrets of the competitors company. So the world is full of hackers and threats. Do you know how to be safe and what to do in this bad cyber world.
Hackers or cyber criminals are the persons who use their computer knowledge for accessing or stealing without authorization. Now most of the security organizations have proposed to declare cyber criminal as terrorists. Hacking is the biggest problem now a day. We can see the past 6 months. Some hacker groups have costs a lot to Sony and some other organizations. They had also accessed and published secret data of some security organizations. They had also hacked some networks and website. Lulzsec and Anonymous are the main 2 hackers groups and cyber police of many countries are in search of the members of these groups. Hackers use all the latest bugs and vulnerabilities to hack and the most dangerous thing is that they know how to hide their real identity in the cyber world. If you look at the recent high profile cyber crime cases, you will see that the hackers have cost a lot to the most reputed companies by stealing their network data and secret information. But they are still unknown. No one knows who are they? where they live?, how they do?
Sometimes I think they are most advanced than the security experts working on those companies but they do not have that much educational qualification. They are talented but use their knowledge in bad works.
Working process of hackers is similar. The complete hacking can be defined as a set of steps performed by hackers. These are Information gathering, scanning, gaining access, maintaining access and clearing tracks. Information gathering and scanning involves getting knowledge about the target system or victim whom they want to hack. After having enough knowledge about the target system, hackers try to exploit vulnerabilities of the target and gain access to unauthorized data. Then they maintain access to get some secret data of the company and steal important information. Finally they clear all the tracks so that no one will able to find them. This is what they are invisible on the internet.
Figure1: Steps performed by hacker
Catching a hacker is not so easy. But securing your network is much easy and recommended.
Need of Ethical hackers
So most of the organization now hire hackers who try to secure the company system security by finding vulnerabilities and security holes. These hackers are called Ethical hackers. An Ethical Hacker will follow the same Techniques and Methodologies as a Malicious Hacker, however, in the end, The found vulnerabilities of Security Flaws are either Reported (Responsible Disclosure/Open Disclosure) or Fixed. This is also called Penetration Testing which is also called as pentest in short. Working of ethical hackers can also be shown as a graphical image which is given below.
Figure2: Steps performed by Ethical hacker
If you take a look on the steps performed by hackers and ethical hackers, you will see that the starting 3 steps are similar in both hackers. But the last steps are different. Ethical hacker reports the vulnerabilities to the organization while hackers maintain the access to access secret data of the company and then clear all the tracks. Reporting vulnerability is the main work of Ethical hacker. Now company will have to work on patching those found vulnerabilities. This is what we called best step of protection against hackers.
“One of the first examples of ethical hackers at work was in the 1970s, when the United States government used groups of experts called red teams to hack its own computer systems.”
Skills Required Becoming an Ethical Hacker
Ethical hackers are those persons who stay 1 step ahead from the malicious hackers so they must be computer system experts having knowledge about computer programming, networking, operating systems, web programming and various security aspects. Ethical hackers do not need to have strong command of the countermeasure that can prevent attacks. Their work is only to report the vulnerability to the organization’s security team.
Ethical hacking has following steps:
1. Talk to the client, and discuss the needs to be addressed during the testing of system, network or application.
2. Prepare and sign nondisclosure agreement (NDA) documents with the client.
3. Organize an ethical hacking team, and prepare a schedule for testing.
4. Conduct the test.
5. Analyze the results of the testing, and prepare a report.
6. Present the report to the client about the vulnerabilities.
But the most important things which an Ethical hacker should know that No ethical hacking activities or testing associated with a network security test or system security audit should be start until a signed legal document has been given to ethical hacker express the permission to perform the hacking and testing activities on network or system is received from the target organization. This type of legal document is necessary because it can cause a trouble to the ethical hacker if he does not have proof to show that he has been allowed from the company.
The other important thing which he should know is that the details of the ethical hacking report must be kept confidential, because they highlight the organization’s security risks and vulnerabilities. If this document falls into the wrong hands, the results can be harmful for the organization.
In security field one more term is used vulnerability assessment which is simply identifies and reports noted vulnerabilities. But it is not the same thing as Penetration testing. Penetration testing tries to exploit those vulnerabilities for unauthorized access. It’s not a onetime action. It should be done regularly.
Penetration testing
Penetration testing is very important for anyone who stores important and sensitive information in systems. The only way anyone can be sure there are no security risks are if they have had their entire security system assessed and then made adjustments as necessary. This can only be done by penetration testing. You can see the steps in process of penetration testing in the figure below.
Figure 3: steps in penetration testing
You can see that the last step is re test. Now you can understand why I wrote that penetration testing should be done regularly.
With the advancement in technology, hackers try to create new type of attacks, so all the older countermeasures will not work against these attacks. This is the reason why ethical hackers need to update their information on these types of new attacks so that they can create a good protection against these attacks. They should learn how these attacks are performed and then try to attack it on the network or systems, to check if systems are really secure. If not, then they try to secure systems and networks to prevent these attacks. So the new attacks are the reason why penetration testing is a regular process.
“The Information Assurance Certification Review Board (IACRB) manages a penetration testing certification known as the Certified Penetration Tester (CPT). The CPT requires that the exam candidate pass a traditional multiple choice exams, as well as pass a practical exam that requires the candidate to perform a penetration test against live servers.”
Penetration testing can be carried out by several ways but in general we define as following 2 types
Black box penetration testing: In this type of penetration testing tester have no prior knowledge of the infrastructure to be tested. He should get all the information about the infrastructure of the network by some testing, guessing and skills. This testing is like the real attack on the system or network by the hackers. Because tester also has no given information about the infrastructure. Many companies use this type of penetration testing because this is the real time testing which feels like real hackers are doing on the network. But it slows down the system and network performance during testing time because there are so many testing tools used by the testers which use bandwidth and resources.
White box penetration testing: In white box penetration testing tester has complete knowledge of the infrastructure to be tested such as network diagram, source code of application, server settings. This information helps tester in his work. But this type of testing is not so effective.
Gray box penetration testing: This is the combination of black box and white box testing. In this some information are given to the tester not all. This type of testing is used in most of the organizations. It takes less time with more vulnerability exposure. It is easy to work for testers in this type of testing.
Risks involved in penetration testing
But penetration testing must be done carefully. It also has some risk. In white box testing, tester has access to the code and during testing it can harm the code by mistakes. And in black box testing tester use so many tools to scan and attack on the network or systems which slow down the system performance of the network or system. The possibility exists that systems may be damaged in the course of penetration testing. Every attack has some negative impact on the network and the system and it may cause some times loss to the company. But it can be minimized by hiring experienced professionals and monitoring all the steps. Backup of all the things is also necessary. But the most dangerous risk is information leakage of the company. The person hired for the penetration testing of the company should work under proper guidance of the company. As part of company’s penetration testing team, he will be able to know all the hidden secrets of the company. The hidden infrastructures and network loop holes. If he is not monitored properly, he can misuse those information are leak the information to other companies which are your competitors in the market
Conclusion
So we can say that ethical hacking and penetration testing are related to each other. Penetration testing is done with Ethical hacking with protection against attacks. In general the testers in the process of penetration testing are Ethical hackers. They can be the part of the company or some individual persons hired by the company for the network and system testing. Most of the company hire some certified ethical hackers to be a part of the company’s security team but most of the famous ethical hackers work on hourly basis and do not want to join any company. So companies hire them for their work. But company should track all the work done by Hired Ethical hacker because he is not the company person but he will have all the secret details such as security infrastructure of the company. He may leak the company secret information to other company. So it’s really important to take care while hiring any Ethical hacker for the company.
Cyber crimes are increasing day by day so need of ethical hackers and penetration testers are also increasing. Having a permanent Ethical hacker is secure than hiring some out members. SO many companies are now hiring permanent Ethical hackers for the company. This can be a better career option for a person having interest in computers and network security. There are many reputed organizations which conduct exams and running courses for penetration testing and ethical hacking. One can join those institutes for being a certified ethical hacker and penetration tester.
