Ethical Hackers, isn't that an oxymoron? 1
So, we talked a little bit about all the 2
different attackers and the hackers 3
methodology at this point, so now we want 4
to talk about the good guys, the ethical 5
hackers for a moment. They do a lot of 6
the same things, and in fact, sometimes 7
they even use some of the same tools. So, 8
when we look at their methodology, it's 9
going to look very similar. The big 10
difference is we have a step at the 11
beginning and a step at the end for ethical 12
hackers. So, ethical hackers follow a 13
similar methodology, but there's a couple 14
of key differences. One is they get 15
permission, the second is everything they 16
do is reversible. They're not trying to 17
do harm to the network. The goal here is 18
to look at the organization and identify 19
the weaknesses, not to hurt the 20
organization. So, when we look at the hacker's 21
methodology, we had six steps. Now, when we 22
put on the ethical hacker's methodology, 23
we're going to add a step of the 24
beginning and step at the end. The first 25
step we're going to add is approval. 26
We're going to get permission before we 27
do anything. Now, the reason why this is 28
really important, is again we've talked 29
about it before, but hacking is illegal. 30
You cannot hack anybody's networks. You 31
have to have written permission from the 32
network owner or own the network 33
yourself. So, an ethical hacker will 34
always have a written document, and we 35
like to affectionately call this "the get 36
out of jail free letter." Ethical hackers 37
are employed, or contracted by the 38
organization's they hack. They are 39
brought in, and they are asked to hack 40
those networks. You have to have that 41
letter in writing to make sure you don't 42
get in trouble. Remember, hacking is a 43
felony in the United States, so you have to 44
make sure you have that 45
get-out-of-jail-free letter. And I can't 46
stress this enough, always, always, always 47
have it in writing. The writing should 48
tell you exactly what it is you're 49
allowed to hack, and what the scope is. 50
For instance, if I'm going after 51
Microsoft, maybe they only want me to go 52
after their Hotmail service, they don't 53
want me to go after everything, that would be 54
in that get a jail free letter. Same 55
thing with any organization you go after, 56
you have to have a very clearly scoped 57
so you know what is and what is not in 58
bounds for the assessment. So, after we 59
get permission, we go through the six 60
standard steps of the hacker's 61
methodology. So, the last step, and most 62
important step, is reporting. Reporting is 63
going to be that list of all the things 64
that you found during your penetration 65
testing. You're going to document things 66
like how you got in, what the weaknesses 67
were, and how you recommend that they fix 68
them. One of the most important things 69
you should do is provide a prioritized 70
list. So, just because you found 15 or 20 71
different ways of getting in, you need to 72
tell them that this is the most 73
important way, fix this first because 74
this is a vulnerability I found 75
200 of your machines, whereas the other 76
one I might have only found it on one. 77
Now, they're going to want to fix 78
everything eventually, but it helps them 79
when they're trying to figure out where 80
should they spend their money quickest, 81
and first, to get the most bang for their 82
buck. And remember, your report should be 83
clear, concise, and most importantly, be 84
useful.