How Ethical Hacking Can Improve Your Security Posture

Cyber security professionals see some threat actors or outside-parties as adversaries. However, challenging this mindset is important; you can better protect your organization against outside-parties if you understand how they think and operate. With this in mind, businesses around the globe have turned to hackers to test security infrastructure and develop stronger, more robust security practices.

Before deciding which penetration testing strategy could be right for your security policy, it is important to understand the different types of hackers that exist.

Each group has differing motivations, and you must be clear on which of their skills can be used to your organization’s advantage. 

Unauthorised Hacker 

Unauthorised hackers are cyber criminals motivated by personal or financial gain. They range from teenage amateurs to experienced individuals or teams with a specific remit. However, over recent years, several high-profile unauthorised hackers have refocused on using their cyber skills to protect organizations. An example is Kevin Mitnick aka Condor, who was just sixteen years old when he gained access to a Department of Defence computer.  Following this and numerous other hacks, Mitnick spent five and a half years in prison. Upon his release, he set up his own company, Mitnick Security Consulting, which now runs penetration tests for clients. 

The issue of whether to work with a previous unauthorised hacker is a contentious one. Some, including David Warburton, senior threat evangelist at F5 Networks, believe that hiring ex-hackers is critical in staying ahead of the threat landscape. However, others are concerned about allowing this group access to corporate systems and customer data. The latter group should, however, consider other approaches to working with hackers.  

Authorised Hacker

Often referred to as ethical hackers, authorised hackers are employed by organizations to look for vulnerabilities in security defences. Despite using the same tactics as unauthorised hackers, this group has permission from the organization making what they do entirely legal. While they use their knowledge to find ways to break the defences, they then work alongside security teams to fix issues before others discover them.

Many of the biggest organizations in the world, including General Motors and Starbucks, are turning to ethical hackers to help identify fault lines and proactively enhance security posture. Authorised hacking can offer an interesting and lucrative career path for people with technical skills. Drawing attention to the important role authorised hackers play can encourage more talented individuals to take a positive path instead of becoming unauthorised hackers.

Nurturing Talent

There are many programmes in place to find, encourage and support the next generation of authorised hackers. An example, supported by AWS, is r00tz Asylum, a conference dedicated to teaching young people how to become ethical hats. Attendees learn how hackers operate and how cybersecurity experts defend against hackers. The aim is to encourage people with technical expertise to use it for good in their career.  By equipping aspiring cybersecurity professionals with knowledge and skills, they can bake security into infrastructure, from the ground up. AWS’s support for r00tz is our chance to give back to the next generation, providing young people who are interested in security with a safe learning environment and access to mentors.

Building On Solid Foundations

For those responsible for maintaining customer trust and protecting data, an end to end approach to security is critical. As we have seen, working with ethical hackers is a powerful way to view security posture from a cyber-criminal’s perspective to identify and tackle vulnerabilities. However, it’s also important to remember that security needs to be baked in throughout an organization’s infrastructure. This is where partnering with a cloud platform can be beneficial; the best of these are developed to satisfy the needs of the most risk-sensitive organizations. Cloud platforms also offer automated security services, which can proactively manage security assessments, threat detection, and policy management.

In so doing, these platforms take on a lot of the heavy lifting for security professionals, including ethical hackers.

Esteban Hernández is a  Specialist Solutions Architect, Security at AWS

You Might Also Read:

The Value Of Network Pen Testing To Reduce Cyber Attacks:

 

« REvil Ransomware Gang Leaders Arrested in Poland
Microsoft Gets Serious About Dealing With The Skills Shortage »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

NSFOCUS Information Technology

NSFOCUS Information Technology

NSFOCUS is a global service provider and enterprise DDoS mitigation solution provider.

Continuum

Continuum

Continuum is the IT management platform company that allows Managed IT Services Providers to maintain and back up on-premise and cloud-based servers, desktops, mobile devices and other endpoints

CloudLayar

CloudLayar

CloudLayar is a cloud-based website firewall for protecting your website against online threats.

Detack

Detack

Detack is an independent supplier of IT security auditing and consulting services.

Netresec

Netresec

Netresec is an independent software vendor with focus on the network security field. We specialize in software for network forensics and analysis of network traffic.

SafeBreach

SafeBreach

SafeBreach's platform simulates hacker breach methods across the entire kill chain to identify breach scenarios in your environment before an attacker does.

Smoothwall

Smoothwall

Smoothwall develop intelligent web filtering, Monitoring and security solutions designed to protect users worldwide.

Cyberra Legal Services (CLS)

Cyberra Legal Services (CLS)

Cyberra Legal Services provides cyber law advisory, cyber crime consultancy, cyber law compliance audit, cyber security, cyber forensics and cyber training services.

Epati Information Technologies

Epati Information Technologies

ePati Information Technologies is a specialist in information technology and cyber security.

VIPRE Security Group

VIPRE Security Group

VIPRE Security Group is an award-winning global cybersecurity, privacy and data protection company.

Pryv

Pryv

Pryv is a Swissmade software for privacy, personal data collection, usage, sharing and storage.

Dataprovider.com

Dataprovider.com

Our Brand Protection Suite gives you the tools to discover trademark infringement on the Internet, such as websites selling counterfeit products, even when this is not immediately noticeable.

Atakama

Atakama

With Atakama, data remains encrypted until the very moment it is used, and the ability to decrypt is based on zero trust architecture.

Cyber Defense Technologies (CDT)

Cyber Defense Technologies (CDT)

Cyber Defense Technologies provides services and turn-key solutions to secure and maintain the integrity of your organization’s systems and data against attacks.

Credible Digital Security Pvt. Ltd. (CDSPL)

Credible Digital Security Pvt. Ltd. (CDSPL)

CDSPL is an innovative Cyber Security Services Company in India. We are committed to offering cyber security solutions for important sectors such as energy and utilities, healthcare, and more.

Prime Technology Services

Prime Technology Services

Prime Tech are a group of Red Hat, Microsoft & Cisco Certified IT Professionals with an impressive track record of consistently delivering value to our corporate clients.