What Is Ethical Hacking?

As you may know, Fluid Attacks is a company that specializes in ethical hacking. We are a big red team, an offensive security team with the mission of detecting security vulnerabilities in IT systems. As we recently realized that we didn't have an informative, introductory blog post about what ethical hacking is, we decided to create it. This text is aimed mainly at those who are new to the subject and want to get an introduction. It is partially based on a recent workshop given by our VP of Hacking, Andres Roldan, to a group of journalists.

It is said that almost five billion people currently use the Internet, which corresponds to nearly 63% of the world's population. Moreover, around 92% of these users, at some point, virtually from anywhere, have access to the network through mobile devices. We are undoubtedly in a highly interconnected digital world where, as in the "tangible" reality, menaces exist from the outset. In the face of constant threats, cybersecurity has become necessary. Gartner, partially right, defines this term as "the combination of people, policies, processes and technologies employed by an enterprise to protect its cyber assets." (I said "partially" because it is also true that as an individual user, you can access cybersecurity). But what should cyber assets be protected against? —Cyberattacks.

These are assaults carried out by cybercriminals who attack one or more IT systems from one or more computers. Cyberattacks can disable victims' systems, steal their data or use them as launching points for other assaults. According to an IBM security report, the top cyberattack types (tactics) last year included the following: ransomware, unauthorized server access, business email compromise, data theft and credential harvesting. And among the most frequently used techniques to achieve these objectives were the following: phishing, vulnerability exploitation, stolen credentials, brute force and remote desktop.

Many cybercriminals who execute the assaults are so-called malicious hackers, threat actors or black hat hackers. Among their primary motivations is the idea of obtaining some financial reward. They may also attack just to express their disagreement with the decisions of governments or companies. There are also attacks resulting from the mere desire of hackers to take risks and achieve recognition in certain groups of people. Sometimes, cybercriminals are even hired by dishonest firms to spoil projects and affect the reputation of their rivals. Something similar happens among governments (e.g., the Russia-Ukraine cyberwar). (If you want to know more about how hackers think, visit this blog post.) Regardless, in a universe where we can experience lots of counter-stimuli, it is to be expected that there are white hats if there are black hats. Namely, if there are malicious hackers, there are also ethical hackers.

An ethical hacker or white hat hacker is an offensive cybersecurity expert who executes cyberattacks mainly in favor of the security of others. Should you still have the question "How are ethical hackers different from malicious hackers?" on your mind, we invite you to read our post "Hacking Ethics". There, we explain how both groups may share qualities such as curiosity, cleverness, and patience, but they are vastly different when it comes to their purposes and the effects or consequences of their actions.

We already have a blog post in which we answer this question. There, we tell you about the technical and non-technical skills you should possess to be an ethical hacker and about the certifications you should get to improve your knowledge and recognition.

Ethical hacking is perhaps the best way to respond to malicious hacking. Ethical hackers examine and attack systems to find out, and sometimes exploit, their vulnerabilities by copying threat actors' tactics, techniques and procedures. The big difference is that the attack is carried out with the system owner's consent, who will be responsible for remediating the reported security vulnerabilities. Ethical hacking is thus a methodology for assessing IT systems in which the tests are intended to simulate as closely as possible the attack methods of cybercriminals, but not to do harm, but instead to enable organizations to overcome their weaknesses and optimize their protection of operations and assets.

In ethical hacking, experts must keep up to date on the existence and use of hacking tools, as well as on the attack trends used by adversaries. In their reports, ethical hackers provide information about identified vulnerabilities, including how critical they are. They do this by following public frameworks such as CVE and CVSS. They also provide evidence of the exploitation of vulnerabilities and which information assets can be compromised in an attack. Beyond finding known vulnerabilities, ethical hackers can also conduct research to discover and record zero-day vulnerabilities, i.e., previously unknown threats.

Ethical hacking is a rather broad concept that, while often used interchangeably with terms such as "pentesting" and "red teaming," it might be more accurate to say it encompasses both methodologies. Let's clear this up.

We have said time and again that penetration testing is a type of security testing in which human intervention is essential. (Even though many providers claim they offer such "automated pentesting.") People trained to do penetration testing, i.e., to understand the infrastructure and functionality of different IT systems, recognize and detect their security vulnerabilities, and, if necessary, take advantage of them to provide tangible signs of potential impacts, can be identified as hackers. Therefore, an ethical hacker doing pentesting is doing ethical hacking.

What is sometimes suggested by some people as a difference between ethical hacking and penetration testing is the breadth of their scope of testing. It's said that pentesting is more oriented to evaluate with predefined methods specific systems to verify they comply with security standards requirements for certain assets, while ethical hacking aims at a broader coverage, and its methods may not be predefined. (This is similar to the comparison we once made between red teaming and pentesting). However, both procedures are tasks performed by ethical hackers. So, going back to the initial statement, both can be seen as ethical hacking. On balance, pentesting is a form of ethical hacking.

Then, regarding the previous section, it is curious to find on the Internet that some companies or media tell us that the types of ethical hacking vary according to the systems they intend to evaluate (e.g., web apps, networks, IoT). Isn't this what should be done instead to separate the types of pentesting (procedure targeting specific systems)? In fact, that was something Chavarría already did in another of our blog posts. (If you want to understand the difference between white, gray and black pentesting, read this post.) Here, we can say that among types of ethical hacking, we could include penetration testing and red teaming, but the intention is not to muddle the waters.

For the ethical hacking process to happen, the systems' owner must previously define and approve an attack surface and a target of evaluation (i.e., part or all of the attack surface). The targets can be web or mobile apps, APIs and microservices, thick clients, cloud infrastructure, networks and hosts, IoT devices and operational technology. The commonly used ethical hacking methodology can be divided into reconnaissance, enumeration, analysis, exploitation and reporting phases.

In our main blog post about red teaming, we had already provided a list of 23 tools used by hackers for the different phases of that form of evaluation, which, as we said, can be seen as a type of ethical hacking. Since you can access that list, in this case, we want to complement it with some other tools used by our ethical hackers in our Continuous Hacking Advanced plan.

Follow this link if you and your company are interested in knowing details about Fluid Attacks' Ethical Hacking solution. But if what you'd like is to wear a white hat and be an ethical hacker on our red team, follow this one. For more details on each case, don't hesitate to contact us.