Perimeter
3/16/2017
10:30 AM
Amit Ashbel
Amit Ashbel
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Ethical Hacking: The Most Important Job No One Talks About

If your company doesn't have an ethical hacker on the security team, it's playing a one-sided game of defense against attackers.

Great power comes with great responsibility, and all heroes face the decision of using their powers for good or evil. These heroes I speak of are called white hat hackers, legal hackers, or, most commonly, ethical hackers. All these labels mean the same thing: A hacker who helps organizations uncover security issues with the goal of preventing those security flaws from being exploited. If companies don't have an ethical hacker working for them, they're in a one-sided game, only playing defense against attackers.

Meet the Hackers
Companies house both developer and security teams to build out codes, but unfortunately, there often is little communication between the two teams until code is in its final stages. DevSecOps — developer and security teams — incorporates both sides throughout all of the coding process to catch vulnerabilities early on, as opposed to at the end, when making updates becomes harder for developers.

Although secure coding practices and code analysis should be automated-  and a standard step in the development process - hackers will always try to leverage other techniques if they can't find code vulnerabilities. Ethical hackers, as part of the DevSecOps team, enhance the secure coding practices of the developers because of the knowledge sharing and testing for vulnerabilities that can be easily taken advantage of by someone outside the company.

Take, for example, Jared Demott. Microsoft hosts the BlueHat competition for ethical hackers to find bugs in its coding, and Demott found a way to bypass all of the company's security measures. Let that sink in for a moment — he found a way to bypass all of Microsoft's security measures. Can you imagine the repercussions if that flaw had been discovered by a malicious hacker?

Let the Hackers Hack
Security solutions (such as application security testing and intrusion detection and prevention systems) are a company's first line of defense because they're important for automatically cleaning out most risks, leaving the more unique attack techniques for the ethical hackers to expose. These could include things such as social engineering or logical flaws that expose a risk. Mature application security programs will use ethical hackers to ensure continuous security throughout the organization and its applications. Many organizations also use them to ensure compliance with regulatory standards such as PCI-DSS and HIPAA, alongside defensive techniques, including static application security testing.

You may be thinking, "What about security audits? Wouldn't they do the trick?" No, not fully. Ethical hacking is used to build real-world potential attacks on an application or the organization as a whole, as opposed to the more analytical and risk-based analysis achieved through security audits. As an ethical hacker, the goal is to find as many vulnerabilities as possible, no matter the risk level, and report them back to the organization.

Another advantage is that once hackers detect a risk, vendors can add the detection capability to their products, thus enhancing detection quality in the long run. For example, David Sopas, security research team leader for Checkmarx, discovered a potentially malicious hack within a LinkedIn reflected filename download. This hack could have had a number of potential outcomes, including a full-blown hijacking of a victims' computers if they had run the file. It's probably safe to say that just the audit wouldn't have identified this hidden flaw.

How to Hack
The good news for companies searching for someone to fill this role is that there are several resources for their own employees to learn more about ethical hacking and become a more-valuable asset.

The first step is to get certified. EC-Council has resources and certifications available, and if you want to continue brushing up on your ethical hacking skills, OWASP has you covered. While getting certified isn't a requirement, I highly recommend this, because getting the basics down will help to provide a foundation on which to build. After you have the basics down, there are many tools and automated processes that can be utilized, but ethical hackers usually use penetration testing and other, mostly offensive, techniques to probe an organization's networks, systems, and applications. In essence, ethical hackers use the same techniques, tools, and methods that malicious hackers use to find real vulnerabilities.

One Small Step for Companies, One Giant Leap for Hackers
What does this all mean for companies? Well, companies must first acknowledge how ethical hackers can help them. Strong application security programs need to focus both on the code security as it's being developed, as well as in its running state — and that's where ethical hacking comes into play. Nothing beats secure coding from the get-go, but mistakes do happen along the way, and that's where ethical hacking experts can make a difference in an organization.

At the next meeting on staffing, ethical hackers should be right at the top of the list of priorities to keep your company, and its data, safe. 

Related Content:

Amit Ashbel has been with the security community for over a decade and has taken on multiple tasks and responsibilities, including technical positions and senior product lead positions. Amit has experience with a wide range of security solutions, including network, endpoint, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NSHAH
50%
50%
NSHAH,
User Rank: Apprentice
3/23/2017 | 6:00:06 PM
Offensive Security Mindset is Vital
Well written article articulating the importance of ethical hacking in light of the dynamic threat landscape. Resources cited are very useful. An effort to get a certification exposes one to structured approach and one can learn a lot from a fundamental knowledge perspective and continue to build on that with large number of on-line resources available. Things have dramatically changed over the course of last few years in terms of access to learning experiences. There are plenty of on-line resources to get a hands on learning experiences including but not limited to Kali Linux (https://www.kali.org/), Pentesterlab (https://pentesterlab.com/), vulnerability hub (https://www.vulnhub.com/), seminars (Defcon, Blackhat, local cons, etc.) webinars and local chapter meetings from professional security organizations (ISSA, ISC2, ISACA, HTCIA, etc.)

 
aashbel
50%
50%
aashbel,
User Rank: Author
3/22/2017 | 1:06:11 PM
Re: Blurry Lines, but Important Distinction
Hey MarkW35801,

I definitely agree with your point of viiew. I think that in a few years we will be seing ethical hackers more frequently employed by a wider variety of businesses. The work has to start though much earlier by creating proper formal education programs as part of comuter sciences degrees. I think that educating developers and creating a hybrid security and development engineer could also make the process more fluent especially considering the fast paced development environments we are seing today. I agree that good pen testing services are important but as you say, they are expensive. By having developers part of the security effort pen test cycles will shorten and become much more effective. 

 

Thanks

Amit
ramgopalvarma219
50%
50%
ramgopalvarma219,
User Rank: Apprentice
3/20/2017 | 2:46:37 AM
Re: Blurry Lines, but Important Distinction
 

 

 

    Hi , Thanks for the article regarding Ethical Hacking , It was informative :)
MarkW35801
50%
50%
MarkW35801,
User Rank: Apprentice
3/16/2017 | 11:22:19 AM
Blurry Lines, but Important Distinction
Being an ethical hacker since late 2000, I can't agree with you more that it's a very important job. And I say this not because I want to remain employed, but because of the places we've been able to break into, and resulting impact to the organization should an attacker have done what we were able to do.

For example:

- we were able to fully compromise a large Western city in a few hours. Complete control of everything - security cameras, badging system. We were able to remote open the police gun vault, the police holding cell...

- using an unauthenticated SQL injection attack over the Internet, we were able to download the entire database of a background check company. Every person they had ever conducted a background check on - all their gory personal details...

We find very serious vulnerabilities, most of which are NOT identified by a vulnerability scanner. We apply logic and reasoning to identify a vulnerability, exploit it, and see where it gets us. Often times when we gain "the keys to the kingdom", we exploit a series of vulnerabilities - it's never just one thing.

A good penetration test isn't cheap, and a cheap penetration test isn't good. But we often find issues that would put a company out of business, so in the end, I believe we are worth the cost.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.