Start Thinking Like A Hacker

The list of large and medium-size companies whose internal systems have been hacked has grown rapidly in recent years and now includes such high-profile exploits as SolarWindsKaseya, Ireland's Heath Service and many others. 

In many cases, cyber security breaches can go undetected for weeks and months before they’re discovered.  Cyber security breach response times can be a crucial factor in the data breach scale, its mitigation, the determination of its source, not forgetting the future legal issues involving the disclosure period. 

Computer security is a unique field. Unlike other fields in which the challenge is to overcome the scale of a problem or the complexity of an algorithm, in computer security the challenge is the wit of another human being who is trying to carry out an attack in order to compromise and disrupt a computing infrastructure. The saying, "If you can't beat them, join them." certainly  applies to cyber security.

To really get inside the mind of a hacker, you need to think like a hacker and this approach is known as "white hat" hacking.

Malicious actors will search for the easiest way in and as you know, social engineering techniques are typically a piece of the plan. In other words, humans are the easiest to hack. Today, there is a pressing need for security professionals to develop vulnerability analysis skills. Vulnerability analysis is the process of analysing a networked system to identify possible security problems.  While there are a number of scanning tools that can be used for network analysis, an in-depth analysis requires a more holistic approach that takes into account the design of the network, its goals, and its actual configuration. Given this information, it is then necessary to identify the underlying assumptions of the system's design, especially the undocumented ones.

To succeed as a cyber security analyst, you need to understand the traits, values, and thought processes of hackers, along with the tools they use to launch their attacks. 

Three Core Values  Characterise A Hacker’s Thinking

Curiosity:   Curiosity drives hackers to explore and understand systems, networks, and software in order to identify vulnerabilities. Not only are they constantly seeking new knowledge and skills to improve their abilities and stay ahead of security measures, but they’re also constantly applying newly learned approaches, tricks, and techniques in different systems, to see what sticks.

Aggressivel Attitude:   An adversarial attitude is a mindset that is always looking for ways to defeat security measures, challenge the status quo, and push the boundaries of what is possible. Hackers are often driven by a desire to prove their own abilities and to test the limits of systems and networks.

Persistence:   Persistence is an important trait for hackers as they often need to try multiple approaches and techniques in order to find a way into a system. They may encounter roadblocks and failures, but they don’t give up easily.  But they will continue to work until they have achieved their goal.

Cyber security teams need to identify and remediate all vulnerabilities while a hacker needs to find only one. The relentless pursuit of vulnerabilities is at their core.

The majority of hackers do not think they will suffer consequences and often go after low-level employees because they think there is less risk of getting caught. This thought pattern makes sense because IT administrators and contractors tend to have direct access to servers and other systems housing sensitive data. Furthermore, these contractors or third-party vendors are an excellent choice because they do not work directly within the company, the standards of how they handle data more often fall short. 

If you understand that framework, you're one step ahead in finding the right tools that will help you to gain visibility into critical assets like user data, endpoints, servers, and SaaS applications, allowing you to find the next vulnerability before it's exploited by a hacker.

Dark Reading:    I-HLS:       Techguard:       MITSloan:     Hacker News:    MasterDC

You Might Also Read:

How Ethical Hacking Can Improve Your Security Posture:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 



 

« Securing Hybrid Workplaces
Australia’s Victoria Leads On National Cyber Strategy »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

AirCUVE

AirCUVE

AirCUVE provide authentication and access control solutions for networks and mobile security.

SGG Global

SGG Global

SGG Global is a leading B2B events, summits and conferences host working across the cyber security, commerce and technology sectors.

Siemplify

Siemplify

Siemplify provides a holistic Security Operations Platform that empowers security analysts to work smarter and respond faster.

Tessian

Tessian

Tessian (formerly CheckRecipient) is a next-generation email security platform that helps enterprises counteract human error and significantly reduce the risk of data loss.

TCDI

TCDI

TCDI specializes in computer forensics, eDiscovery and cybersecurity services.

MINSEG-CSIRT

MINSEG-CSIRT

MINSEG-CSIRT is the Computer Security Incident Response Team of the Argentine Ministry of Security.

Assertion

Assertion

Assertion secures your collaboration (UC/CC) systems from cyber risks. Enforcing the right set of controls and monitoring them continually brings down risk to acceptable levels.

Zighra

Zighra

Zighra is a leading provider of On-Device AI solutions for continuous authentication and fraud detection on mobile and web applications.

Y-PARC

Y-PARC

Y-PARC is a center of excellence for cybersecurity, precision industries and medtech, fostering innovation and development and support for startups.

Paladin Cyber

Paladin Cyber

Paladin Cyber provides comprehensive cyber protection for small and medium businesses through differentiated insurance programs and easy-to-use technology.

CyVolve

CyVolve

Cyvolve is the next great leap forward in data security, ensuring constant encryption and pervasive control over all your data.

David Hayes-Export Controls

David Hayes-Export Controls

David Hayes-Export Controls provides assistance to companies affected by export controls or who are considering entering the market but are unsure of the commercial and regulatory implications.

Blaick Technologies

Blaick Technologies

Blaick is an Israeli cyber-security company which deploys proprietary Artificial Intelligence threats detection technology for early prevention of online cyber crime.

Crosspoint Capital Partners

Crosspoint Capital Partners

Crosspoint Capital Partners is a private equity investment firm focused on the cybersecurity and privacy sectors.

Tromzo

Tromzo

Tromzo's mission is to eliminate the friction between developers and security so you can scale your application security program.

Oxford Internet Institute - University of Oxford

Oxford Internet Institute - University of Oxford

The Oxford Internet Institute is a multidisciplinary research and teaching department of the University of Oxford, dedicated to the social science of the Internet.