Ethical hacking

Ethical hacking is a proactive cybersecurity approach that involves the use of hacking methods, concepts, and tools to uncover weaknesses in a system before a potential attacker exploits them.

An ethical hacker thinks like an attacker or a criminal profiler. They know how to steal passwords and usernames, and how to find and exploit vulnerabilities and get away with it. Ethical hackers use the same tactics that the bad guys use. The only difference is that they have permission to do it. Also, ethical hackers bring more to the table. Here are some of the most important skills, ideal behaviors, and principles ethical hackers use:

• Expertise in architectures, programs, and networks – You need to know the ins and outs of how Transmission Control Protocol/Internet Protocol (TCP/IP) works. You need to understand networking structures and functions. You don't necessarily need to be an expert in all programs, but you do need to know how programs are installed, the modifications they make, and the possible security threats they pose.
• Proficiency in vulnerability research – Ethical hackers need to keep up with the bad guys. So, find out as much as you can about new vulnerabilities. Additionally, ensure that you are good at the hacking techniques that attackers use because you might need to try them out on a particular target.
• A good understanding of the hacking techniques attackers use – Ethical hackers are not vendor-specific; they understand the techniques attackers use across the board – the hacks that can be used against routers, Intrusion Detection Systems (IDSes), and so on.
• Follow the code of conduct – Ethical hackers adhere to a strict code of conduct as required by the EC-Council.
• Disclose to the appropriate people – Ethical hackers owe it to their employers and clients to disclose what they ought to. They have a duty to disclose to authorities what they uncover if it is illegal. Ethical hackers also come across vulnerabilities in their clients' systems or infrastructures when evaluating them. The code bars them from exposing such information. They know what is off limits.
• They are good at the tactics and strategies attackers use – They know the tactics and the strategies. They don't just make stuff up or take shortcuts.
• They understand no means no – If a client or employer gives specific guidelines of what's allowed and what's not, an ethical hacker will draw a line between the two and respect that decision. They will not try to cross it, and if there is a change of scope, they ensure it is done in writing.
• They never target a system or network they don't own or are not allowed into – It's not a skill per se, but if during the test a good ethical hacker is told to stop, they do so. Failure to do so has turned the lives of some ethical hackers upside down.
• They note and report results – They report all results, even if it might hurt someone whose good books they want to be in, such as the manager who recommended them for that penetration testing job.
• They report their findings to legal authorities – They know they have a duty to report illegal activities or plans to the authorities and, as such, they ensure that the contract allows that. However, some jurisdictions place a legal responsibility on ethical hackers, even if the contract forbids such disclosures. Failure to report to legal authorities makes the ethical hacker an accessory to the crime. There are other ways out of such situations, including laws such as the Whistleblower Protection Act, which safeguards ethical hackers in specific types of disclosures.
• Confidentiality – When an ethical hacker encounters information that is deemed confidential, they know who to share their findings with, unless it goes against the laws of the land.

Honing important skills, embracing the principles of ethical hacking, and knowing the ways of attackers are key. I wrote this chapter to give you the information you need to pass your CEH exam and know what you need to navigate the cybersecurity world. We've also covered different types of attacks and how attackers exploit vulnerabilities. Our next step is information security controls – our weapon against attackers.