White Hat Ethical Hacking: Purpose, Law, and Certification

Introduction to Ethical Hacking

Ethical hacking is the practice of employing professionals who are knowledgeable about how computer and network systems work to seek out vulnerabilities and deficiencies in a network's security so that companies can understand what other hackers can and cannot access (Bishop, 2007). This type of hacking is performed so that organizations can identify which information is most vulnerable and assess how secure their security systems actually are. Ethical hackers attempt to breach data systems in a non-malicious way in order to determine how much damage those with bad intentions could cause (Palmer, 2001).

The individual who conducts ethical hacking is sometimes referred to as a white hat, as opposed to a black hat — both terms derived from Western films depicting the "good guy" and the "bad guy," respectively. In order for a network to be truly secure, it must be thoroughly examined from the perspective of an unauthorized hacker, and that is precisely what an ethical hacker does (Caldwell, 2011).

The Ethical Hacking Process

The objective of an ethical hacker is to test every type of vulnerability that a network system could have. To accomplish this, ethical hackers must first familiarize themselves with the entire network and its functionalities. The first step in the ethical hacking process is to break into the network itself (Bishop, 2007). After the intrusion is successful, the ethical hacker determines how the accessed information could potentially be exploited by those who intend harm. As a final step, the ethical hacker assesses whether the compromised system would alert those affected by the breach, and identifies ways in which such intrusions could be prevented in the future (Palmer, 2001).

Legal and Technical Issues

The legal issues that ethical hackers must navigate can become blurry given the nature of the work. Hacking is illegal — full stop. It is an act punishable under federal law. Ethical hackers, however, are permitted to carry it out. While the process itself is illegal, it is widely recognized as a necessary one (Whitman, 2011). A further legal complication is that ethical hackers expose themselves as skilled intruders, which itself carries legal implications (Knight, 2009).

On the technical side, ethical hackers gain access to a vast amount of confidential information, which creates concerns that overlap with legal liability (Whitman, 2011). Another significant technical challenge is that once access to a network system is achieved, the primary task is not simply cataloging what was accessed, but rather using that knowledge to strengthen the network so that malicious actors cannot replicate the same intrusion (Caldwell, 2011).

Conclusion

An ethical hacker is a profession that many view as a contradiction in terms, since hacking is illegal and, on the surface, there should be nothing ethical about it. However, in order for real criminal hackers to be identified, prosecuted, and punished, there must be individuals who train themselves to think and act as those criminals do. The practice of penetration testing ultimately comes down to whether the benefits outweigh the risks — and for many organizations and law enforcement agencies, the answer is yes.

References

Palmer, C. C. (2001). Ethical hacking. IBM Systems Journal, 40(1), 769–780.

Bishop, M. (2007). About penetration testing. Security and Privacy IEEE, 5(6), 84–87.

Whitman, M. E. (2011). An etymological view of ethical hacking. In M. E. Whitman & H. J. Mattord (Eds.), Readings and cases in information security: Law and ethics. Cengage Learning.

Caldwell, T. (2011). Ethical hackers: Putting on the white hat. Network Security, 7, 10–13.

Knight, W. (2009). License to hack. Infosecurity, 6(6), 38–41.