What is ethical hacking?
Written by Michael Feder
Reviewed by听Kathryn Uhles, MIS, MSP,听Dean, College of Business and IT
At a glance
- Ethical hacking is a so-called 鈥渨hite hat鈥 cybersecurity tactic that involves attempting to hack a company鈥檚 network to expose and remediate any vulnerabilities.听
- Common ethical hacking techniques include vulnerability assessments, penetration testing, session hijacking, social engineering and wireless networking hacking.
- While companies can retain ethical hackers in an attempt to strengthen their cybersecurity, ethical hackers must receive explicit permission and abide by certain protocols, such as disclosing all vulnerabilities to the company and allowing time to remediate the problems before sharing them with the public.
- Are you ready to join the white hat league? Learn more about how you can help prevent cyber threats with a bachelor of science in cybersecurity听from 爱污传媒.
What is ethical hacking?
Ethical hacking means receiving explicit permission to attempt to bypass a company鈥檚 networks through penetration testing, SQL injection and other means. The goal is to identify vulnerabilities or weaknesses in company systems as well as ways to better defend their servers, devices and data from cyberattacks.
Ethical hacking is a valuable first step for any company looking for insight into their network security. It helps satisfy several core cybersecurity priorities, from network defense to regulation compliance. Many companies depend on regular cybersecurity tests to audit their own information security strategies.
How organizations benefit from ethical hacking
Many companies depend on ethical hackers to secure their networks. A professional certification known as (CEH) trains professionals in specific methods of keeping digital property safe from cyberattacks.
Organizations that conduct regular penetration testing of their in-house computer systems will be better protected from cybercriminals. They鈥檒l achieve higher levels of security through regular tests on system networks that identify weaknesses and how to patch them. When security breaches do occur, companies trained in ethical hacking are also better prepared to respond.
Ethical hacking vs. malicious hacking
Ethical hacking occurs when companies give IT professionals permission to attempt a cyberattack as a way to test the defenses of their computer network. By contrast, malicious hacking occurs without company permission 鈥 often without any company knowledge. While a CEH is motivated to improve a company鈥檚 cybersecurity measures, malicious hackers exploit vulnerabilities for personal gain or financial reward.
While ethical hackers use a variety of techniques, they usually refrain from certain network attacks that may cause harm. Instead, a CEH attempts to breach company networks while doing as little damage to the system or users as possible. For example, they do not typically use forms of malware that can permanently damage computers or internal data.
Malicious hackers do not follow these guidelines. They are content to damage a network鈥檚 infrastructure while extracting valuable information. This means they often use aggressive malware, ransomware, phishing schemes, and to work their way into secure systems.
Types of hackers
Many different professionals conduct hacking. Despite their similar skill sets, they operate with varying philosophies. Some follow white hat protocols, using their skills to help companies identify and patch system vulnerabilities. Others maliciously attack networks to access and sell the information. Still others are considered 鈥済ray hat鈥 鈥 alternating between malicious and ethical hacking practices.
White hat hackers
use their skills for good, helping companies identify and understand where their systems could use IT improvement. They operate strictly within the law and only exploit a company鈥檚 systems with explicit permission.
Certified ethical hackers and penetration testers are synonymous with white hat hackers. Though they鈥檒l use techniques to execute data breaches 鈥 including penetration testing, vulnerability assessments and social engineering 鈥 they don鈥檛 seek personal gain from these actions. Instead, they work to help companies fortify their networks before malicious actors can get in.
Black hat hacker
deliberately operate outside of the law. They use unethical data exploitation techniques to illegally access a company鈥檚 networks, devices and data. Once inside a company鈥檚 network, they often take information hostage until a fee is paid. In other cases, they steal personal information and deliberately disrupt the network鈥檚 infrastructure.
Many black hat hackers operate in teams. They populate online forums or underground marketplaces, where they steal and sell personal data for high prices.
Gray hat hacker
Sometimes operate inside of the law, even sharing information on hacking techniques with companies looking to fortify network security. In other cases, they operate illegally 鈥 using illicit hacking practices or exploiting networks without permission.
Gray hat hacking blends white hat and black hat strategies. They maliciously hack systems, using newfound network access to explore data and applications. However, they may also focus on warning companies about security vulnerabilities.
The role of certified ethical hackers
Ethical hackers are critically important in protecting network safety. Particularly for companies with sensitive digital information, ethical hackers help identify and eliminate vulnerabilities before malicious hackers get the chance.
Collaboration is key 鈥 ethical hackers work directly with business and IT leaders, first diagnosing any problems with network structure or integrity. They perform various exploits 鈥 attempts to enter a network without legitimate passkeys.
After the active attack phase, they provide full reports to company stakeholders. These reports identify any successful exploits, along with opportunities for immediate and long-lasting network improvement.
It鈥檚 also important that company employees understand how to protect themselves against hacking. A CEH may often teach these skills, instructing employees on appropriate responses if they suspect malicious activity. This might include lessons or seminars on security best practices like and data backup.
Common ethical hacking techniques
Ethical hacking is a complicated, multistep process 鈥 one that involves recurring attempts to breach a network without proper access. Hackers use several common techniques to achieve their goals, including:
- : Evaluation of company networks, devices, users and data to identify possible system weaknesses. Methods include looking for vulnerabilities like outdated passwords, old software or unprotected web applications.
- : Simulated attacks on company systems to identify weaknesses hackers might exploit.
- : An attacker gains unauthorized access to a user鈥檚 session ID either by stealing their session cookie or convincing them to click a malicious link that contains a predicted session ID.
- : Strategies that manipulate people to gain network access without any physical hacking. For example, social engineering might occur when a hacker calls an HR department pretending to be a legitimate employee asking for information.
- :听Gaining access to wireless networks, often in the cloud, through weaknesses in controls, configurations or Wi-Fi.
In some situations, a CEH may also depend on physical security techniques. These strategies help identify any vulnerabilities in physical security resources, like locks, security guards and video surveillance systems.
Five phases of ethical hacking
Most ethical hacking takes place in . Let鈥檚 break down each stage, and how hackers go about the process.听
1. Reconnaissance
During the reconnaissance stage, hackers gather as much information and data as possible in a particular network. Hackers also spend time auditing security and identifying potential entry points to scan in the next step.
The information hackers gather depends on the network itself. For example, ethical hackers might come across details like IP addresses, email addresses, databases or webpage links.
2. Scanning
Using information gathered during reconnaissance, ethical hackers directly scan systems for weaknesses. This means focusing on specific areas of a network that might be particularly vulnerable to hacking attempts. It might also mean scanning specific applications connected to company networks that could serve as a viable point of entry.
Network mapping is a major priority during the scanning stage. This occurs when hackers map a network in terms of range, hosts and associated devices. This helps hackers achieve a much better understanding of a company鈥檚 network infrastructure, as well as the access permissions they might find inside.
3. Gaining access
Insight becomes action in this third stage, as ethical hackers attempt to exploit vulnerabilities they鈥檝e identified. They might use techniques in , or authentication bypass to gain unauthorized access to specific ports or files. Hackers might use social engineering techniques if they identify weaknesses in a company鈥檚 workforce.
Once they gain access to a network, ethical hackers attempt to widen their scope of visibility. Where malicious hackers would begin to steal information or install malware, ethical hackers only document their findings. They record specific steps that explain how they broke into the network.
4. Maintaining access
After obtaining access to a network, ethical hackers work to maintain it. This stage mimics a malicious hacker鈥檚 attempts to hold a network open long enough to take control of the system. That process typically involves rootkits and malicious software that more easily enables unauthorized access to a particular system or network.
If an ethical hacker is actively working against a company鈥檚 IT team to hack a network, they often practice persistence 鈥 techniques to reestablish network access after it is cut off. They might also simulate a that establishes consistent network access even if the original entry point is patched.听
5. Covering tracks
Many ethical hackers will further simulate a real-world attack by 鈥covering their tracks鈥 after the hack has concluded. This means hiding evidence that an attack took place. Hackers might modify registry values, revise log files or delete data that suggests illicit network entry.
A first step in hiding hack evidence is revising event logs. Event logs typically record major actions within a specific network, from user login times to file access. Malicious hackers may try to clear these logs to avoid raising suspicion within the organization they just hacked. Ethical hackers follow suit, attempting to erase this evidence before presenting a report to the hiring company.
Ethical hacking tools and resources
Certified ethical hackers use a variety of tools to help save time when scanning networks, identifying vulnerabilities or performing actual exploits.
听Here are some of the most popular resources:
- : An open-source tool that helps hackers introduce custom code into a network for testing and potential exploitation.
- : An open-source tool, short for Network Mapper, that helps scan systems and perform network inventory tasks before proceeding with any exploitation.
- : A remote security tool that scans devices for vulnerabilities, one port at a time.听
- : A dynamic hacking tool that automatically scans for more than 4,500 common vulnerabilities across scanned web applications.
Ethical hackers often use a combination of tools for a single hack, depending on their objectives. Together, these tools help accomplish all five stages of an ethical hack 鈥 from reconnaissance through network exit and reporting.
Challenges faced by ethical hackers
Ethical hackers face a unique set of challenges each day at work, particularly in staying up to date with techniques.
It鈥檚 their job to simulate a malicious attack. To do so, they must stay updated on the latest malware, phishing and hacking trends. They also need to regularly update their tools and their own skills in cybersecurity as hacking practices evolve.
Legal and ethical considerations
An ethical hacker can also face challenges in maintaining compliance. Unlike other professionals, they attempt to emulate illegal activities. Even as they attempt to breach a company鈥檚 networks, they can only perform activities that follow legal guidelines.
Ethical hackers need explicit permission from a company before breaching their systems. Without that permission, hackers鈥 actions are considered malicious 鈥 subject to criminal charges under the .听
They should follow responsible disclosure practices. This means fully revealing all security vulnerabilities after examining a company鈥檚 security. It also means allowing that company sufficient time to fix vulnerabilities before making information public.
How do you become an ethical hacker?
There鈥檚 really no such thing as an entry-level ethical hacker. Many work toward becoming job-ready professionals by gaining experience in related information security and cloud computing roles.听
For example, some cybersecurity analysts eventually grow into roles where they do penetration tests and other vulnerability-management tasks. Experienced software developers may pursue ethical hacker roles after developing overlapping information technology skills in programming, web compliance and application architecture.
Education and training for ethical hackers
Becoming an ethical hacker involves a combination of education and hands-on experience.
Many students begin their journey in the field of ethical hacking with a computer science, cybersecurity or technology degree. These programs teach important skills in cybersecurity, IT, data science and related subjects.
Many pursue education in cyber and network defense to reinforce skills like network analysis and risk management. You can further strengthen your knowledge with a certificate in digital forensics, learning even more about network traffic and threat reporting.
Ethical hacker salary and job description
The U.S. Bureau of Labor Statistics (BLS) categorizes an ethical hacker as a type of . The average salary can vary based on several factors, like location, employer and years of experience. As of May 2023,听information security analysts , with a median wage of听$120,360, according to BLS*.
Here are some of the responsibilities of an ethical hacker:
- Conducting vulnerability assessments that identify a wide range of network weaknesses.
- Penetration testing to identify if it鈥檚 possible to breach a company鈥檚 systems, including its networks and data.
- Explaining to companies how and why their networks are vulnerable to external cybersecurity threats.
- Educating company employees on how they can guard against cyberattacks.
The exact tasks of an ethical hacker depend on the employer鈥檚 needs. For example, some ethical hackers spend more time assessing networks for threats. Others serve more of an educational role in helping employees take personal responsibility for data and network safety.
*Salary ranges are not specific to students or graduates of 爱污传媒. Actual outcomes vary based on multiple factors, including prior work experience, geographic location and other factors specific to the individual. 爱污传媒 does not guarantee employment, salary level or career advancement. BLS data is geographically based. Information for a specific state/city can be researched on the BLS website.
Cybersecurity degrees and education at 爱污传媒
Whether you鈥檙e seeking a basic understanding of cybersecurity or you鈥檙e a working professional looking to expand your IT skill set, 爱污传媒 (UOPX) offers听online course collections, bachelor鈥檚 degrees and master鈥檚 degrees.听Learn more about undergraduate and graduate听online technology degrees and certificates from UOPX听and start your IT journey today!
- Associate of Science in Cybersecurity 鈥 The International Council of E-Commerce Consultants (EC-Council) and 爱污传媒 teamed up to launch the Associate of Science in Cybersecurity degree and elective courses that align with three EC-Council certification exams: Certified Ethical Hacker (CEH), Certified Network Defender (CND) and Certified Secure Computer User (CSCU). Awarded the EC-Council鈥檚 2019-2022 Academic Circle of Excellence Award as a result of this partnership, this program is designed to help you develop the problem-solving skills and techniques needed to defend the cyber domain.
- Bachelor of Science in Information Technology听鈥 In this program, you鈥檒l learn skills including business process, cybersecurity, information systems, operations and systems analysis.
- Bachelor of Science in Cybersecurity听鈥斕齌his online program teaches skills such as security policies, network security, cybersecurity and more.
- Master of Science in Cybersecurity听鈥 This online program explores in depth such skills and topics as cybersecurity, security policies and vulnerability.
- 听鈥 This course collection can help you prepare for the EC-Council Certified Ethical Hacker (CEH) exam. Topics include the phases of ethical hacking, recognizing weaknesses and vulnerabilities of a system, social engineering, IoT threats, risk mitigation and more. Tuition savings and a discounted certification exam fee are offered to non-degree students.
- 听鈥 This course collection can help you prepare for the EC-Council Certified Incident Handler (ECIH) exam. This specialist certification focuses on how to effectively handle security breaches.听Tuition savings and a discounted certification exam fee are offered to non-degree students.
- 听鈥 This course collection can help you prepare for the entry-level EC-Council Certified Network Defender (CND) exam. Courses focus on protecting a network from security breaches before they happen. Tuition savings and a discounted certification exam fee are offered to non-degree students.
- Computer Hacking Forensics Investigator Course Collection听鈥 This course collection can help you prepare for the EC-Council Computer Hacking Forensics Investigator (CHFI) exam.听You鈥檒l learn about the latest technologies, tools and methodologies in digital forensics, including the dark web, IoT, malware, the cloud and data forensics.
- Advanced Cybersecurity Certificate 鈥 You can develop technical knowledge to step into the fast-growing field of IT security, helping keep computer systems safe from data breaches and cyberattacks. You鈥檒l get real-life experience through hands-on IT labs and simulations while developing a broad knowledge of cybersecurity to help prepare you for your technology career.
ABOUT THE AUTHOR
A graduate of Johns Hopkins University and its Writing Seminars program and winner of the Stephen A. Dixon Literary Prize, Michael Feder brings an eye for detail and a passion for research to every article he writes. His academic and professional background includes experience in marketing, content development, script writing and SEO. Today, he works as a multimedia specialist at 爱污传媒 where he covers a variety of topics ranging from healthcare to IT.
ABOUT THE REVIEWER
Currently Dean of the College of Business and Information Technology,听Kathryn Uhles has served 爱污传媒 in a variety of roles since 2006. Prior to joining 爱污传媒, Kathryn taught fifth grade to underprivileged youth in 爱污传媒.
This article has been vetted by 爱污传媒's editorial advisory committee.听
Read more about our editorial process.
听
want to read more like this?
