The internet brought with it the third revolution; a revolution that has interconnected the world like never before. There are currently 5 billion internet users in the world. And this number only increases day on day. From education to healthcare to communications to transport, the internet has permeated every industry to make our lives easier and more convenient. But is the internet a manna from the heavens? Sadly not. While it has brought with it immense opportunities and innovations, it has also brought with it, threat; threat of breach, fraud and attacks. And foremost among these threats is the threat from hackers.
Hackers are sophisticated criminals who can breach cyber security systems and cause loss of money, credibility and trust. In 2017 alone, hacking cost people $172 billion, while it is predicted that by the end of 2020, the average cost of data breaches will be about 150 million.
Apart from the money that is lost, a company that is vulnerable to cyber-attacks also loses face with its customers, making it unreliable. Which is why, to counter these attacks, more and more organizations today are investing in sophisticated cyber security, to protect their data and reputation from hackers.
But how does one know if the security they have in place is fool proof and not susceptible to cyber-attacks? This is where ethical hackers come in. An ethical hacker is a security professional who assesses a system for vulnerabilities that can be exploited for a malicious attack.
Ethical hackers break and build the security for an organization. They have become an indispensable resource in the security market. Right from ecommerce websites to banks, all organizations are investing in ethical hackers who can assess and put a security system in place.
So, how does one become an ethical/white hat hacker? And what’s the career path in this role?
Understanding Ethical Hacking
Ethical Hacking is a legitimate and structured way of hacking, performed to expose the vulnerabilities in the software, web application, or in the network, that can be accessed and exploited by an unauthorized person.
Ethical hacking helps secure both your personal as well as an organization’s IT assets.
There are many threat vectors which attackers use to get the access to a website, software or network. Ethical hackers are trained to identify these and fix them before they are discovered by malicious hackers. In organizations, they are often given the role of a security analyst, security consultant security architect etc.
Some of the tasks of an ethical hacker include:
- Detecting loopholes in a database that can be exploited by any unauthorized person
- Finding vulnerabilities in networks that can be exploited by any attacker
- Educating the employees on how to identify phishing mails and tackle them
- Establishing proper security controls on all the devices.
- Securing your Web applications and websites
- Securing your organization's network
- Regular patching of Infrastructure devices like routers, switches, firewall and servers.
- Establishing perimeter security to protect the organizational network.
- Ensuring User and Access based controls are setup and implemented.
- Input validation on Websites.
Security analyst, security consultant or security architect...these are some of the names given to ethical hackers in the corporate world.
What Ethical Hackers Do
In essence an ethical hacker uses the same tools and techniques that would be used by a malicious or black hat hacker to breach a system. The only difference is that what an ethical hacker does is legitimate, ethical and with the consent of the organization quite contrary to a malicious hacker who hacks a system’s security without user consent.
An ethical hacker’s job involves identifying loopholes and developing and discussing their assessment methods and findings with various IT team and the higher management.
Ethical hackers perform vulnerability assessment on the network, software, and servers. Later they fix those incompetencies so that no unauthorized user can compromise the system’s integrity.
What qualifications does one need to become an Ethical Hacker?
A Computer Science or Information Technology degree is not required to become an ethical hacker. There are many professionals who come from non-technical background and go on to become excellent ethical hackers. What you need is expertise on the latest hacking tools and techniques that you can use to test the system and identify its loopholes.
Some of the defensive approaches ethical hackers use to protect organizations include:
- Regular patching of Infrastructure devices like routers, switches, firewall and servers.
- Establishing perimeter security to protect the organizational network.
- Ensuring User and Access based controls are setup and implemented.
- Input validation on Websites.
And many more.
History of Ethical Hacking:-
The term ‘hacker’ was coined in 1960 at Massachusetts Institute of Technology where some great minds were trying to redevelop mainframe systems using FORTRAN programming. With the dawn of the digital age, hacking became one of the top methods of conducting cyber-attacks. Nation sponsored attacks are a new form of cyber terrorism that can bring countries to their knees.
One of the biggest examples is Stuxnet; a virus attack on the Nuclear program of Iran, which according to Wikipedia was carried out jointly by USA and Israel.
Some of the other victims of hacking are organizations such as:
- Adobe hack: 2013
- Yahoo Hack: 2013
- eBay hack: 2014
- Sony hack: 2014
- Mariott hack: 2018
- Dubsmash hack: 2019
Evolution of the Ethical Hacking role:
Ethical hackers play an important role in securing us in this era, and can be said to be the unsung heroes of the IT industry.
Organizations have greatly expanded the investments made on cyber security after realizing that a breach could cost them more than their turnover. The digital demand in today’s world has ensured that the responsibilities of and the need for ethical hackers is on the rise.
How does Hacking become Ethical?
Hacking can be legal or illegal depending on the intention of the act. If hackers use their knowledge for providing security and protection to any organization, it becomes legal or ethical. When a hacker has the user’s consent to check the security of their system by breaching the system, it is ethical hacking. However, if the security of a system is breached without the user’s consent to perform a malicious act such as stealing passwords, sending spam, damaging/stealing data, making unlawful transactions etc, then that makes it a cybercrime.
Recent Hacking Attacks:-
What do hackers do?
- Perform a data breach
- Get details of the Server
- Get sensitive details from a database
- Crash a website
Some of the more prominent attacks of data breach in recent years include
- In 2015, Barack Obama, Joe Biden, Jeff Bezos, Waren Buffet, Bill Gates, Mike Bloomberg, Elon Musk, Kanye West, and others were victims of hacking.
- Myerscough College, in Billsborrow, Lancashire was attacked by an attacker on their result day. This compelled the staff to email each student about their grades, individually, Even their online enrolment system was affected by the attack.
- A ransomware Wannacry, was used to derail thousands of computer systems including those of Government organizations and private organizations.
- Ashley Madison is a website with the slogan 'Life Is Short, Have an Affair.' This website was attacked by attackers in July 2015, which resulted in the personal data of 37 million users being leaked on public websites. The results were catastrophic and it ruined the reputations and marriages of many.
- In June 2015, the records of 21.5 million people, including social security numbers, dates of birth, addresses, fingerprints, and security-clearance-related information, were stolen from the United States Office of Personnel Management (OPM). Most of the victims are employees of the United States government.
This attack was also considered to be serious due to the leak of private information of the officials.
The attackers used asymmetric cryptography, in which they encrypted the complete system using a public key and stored the private key on their own server. The owner of the system was blackmailed into giving money in exchange for the private key to decrypt that system.
According to McAfee "Rise in Cyber Attacks Amid Covid-19 Resulted in 375 Threats Per Minute in Q1 2020"
What is Vulnerability: -
Vulnerability is a loophole in the system which allows any unauthorized user to get access into the system.
Vulnerability is often a result of misconfiguration of the logic which is implemented for operation or security of the system. Any weakness in a system that can be used to exploit the organization's property is called vulnerability. A flaw in the system makes it vulnerable to attacks. A small configuration error can become a high-level vulnerability.
Generally, vulnerabilities are categorized according to the severity and frequency of occurrence. These are:
Below are some of the different types of vulnerability:
- If Database default credentials are used
- If Server is not properly patched
- If Session time out is not properly configured
- If Server is executing data entered in input field as a command
- If handling of data is not properly implemented.
What types of Systems do Hackers target?
Hackers often want to hack those computers or networks from which they know that they will surely get some valuable/sensitive information. Government and Private organizations that store large amounts of sensitive data are especially vulnerable to hacking. Individual hacking is also on the rise were hackers attack individuals to steal money or passwords.
In the times we live, knowledge of hacking and security is a must for every individual and organization to protect themselves.
Ethical hackers are the modern-day vigilantes who protect and serve organizations and individuals by fixing security issues of systems and keeping them safe from attacks.
