Извините, этот текст доступен только на “en” и “ua”.
You’ve probably heard the phrase “you don’t know what you don’t know.” It’s a learning stage most people find themselves at from time to time. When it comes to cybersecurity, hackers succeed by finding the security gaps and vulnerabilities you missed. That’s true of malicious attackers. But it’s also true of their opponents who are on your side: certified ethical hackers.
A certified ethical hacker (CEH) can be one of your most valuable specialists for protecting against threat actors.
What Is Ethical Hacking?
An ethical hacker is a professional penetration tester, an offensive security researcher, and a consultant or employee who practices the arts of cyber hacking. The term ‘ethical hacking’ was coined in the 1990s by former IBM executive John Patrick to differentiate between white-hat hackers and guys from the emerging world of cyber criminals.
Both ethical and malicious cybersecurity gurus can use similar techniques to breach systems and access data on corporate networks. The difference is that some of them are looking to exploit flaws and vulnerabilities for personal gain. Others are making efforts to fix them for the sake of their client. They are also mentioned as white-hat hackers (as opposed to attackers, or black hats). Ethical hackers use their attacking skills for the benefit of the ‘victim’.
What all ethical hackers have in common is that they regard the client’s system through the spectacle of threat actors.
Freelance ethical hackers, doing the work because of the rewards offered by bug bounties or just the challenge of it, can help find vulnerabilities. Anyone can practice ethical hacking. But only certified ethical hackers prove they have the range of knowledge most organizations are looking for.
What Are Certified Ethical Hackers?
CEH certification for non-governmental organizations has two levels. The basic CEH certification is granted after passing a knowledge test. The next CEH Master level requires succeeding in penetration testing on simulated systems.
Three major groups are issuing CEH licenses: the International Council of E-Commerce Consultants, the Certified Penetration Tester course offered by the Information Assurance Certification Review Board, and the Global Information Assurance Certification.
Ambitious cybersecurity workers are highly recommended to gain CEH certification as part of their training.
What Skills Should Develop Ethical Hackers?
A certified ethical hacker should cover three broad skill areas. The first one is the skill and knowledge needed for exploring gaps and vulnerabilities. The key element of this training is the range.
The second is creativity — thinking outside the box and trying uncommon and challenging ways to breach networks. This is a better half of the work. The role of the CEH is to find the blind spots, gaps, and vulnerabilities that have fallen through the cracks.
And the third one is trustworthiness — the professional practice of gaining access to sensitive data while always safeguarding it and never abusing the access granted by the client. CEH pros must take the ethical part of their title seriously. In addition to gaining access to sensitive or private data and keeping it safe and secure, CEHs limit their social engineering to ethical versions of it. For example, it’s ethical to drop a thumb drive in the parking lot to see if an employee picks it up and plugs it in. But it’s unethical, and against the code of the CEH profession, to use threats of violence or violations of personal employee data.
How Can Ethical Hackers Help You
A certified ethical hacker can be very helpful to your organization’s cybersecurity efforts. Here is a checklist of what they can bring to the table:
- Find vulnerabilities, in particular, gaps in software, physical security, or policy
- Dumpster diving and scanning public websites looking for information that can help an attack
- Port scanning with port scanning tools to find open ports
- Figure out how threat actors can evade firewalls, honeypots, and intrusion detection systems
- Penetration testing (The difference between penetration testing and ethical hacking in general, is that penetration testing is scheduled, and more narrowly focused on specific aspects of cybersecurity)
- Help with running a cybersecurity crisis simulation
- Expose insider threats
- Participate in and help organize red team/blue team exercises
- Perform network traffic analysis
- Conduct a wide variety of covert social engineering hacks. They can test not only cybersecurity systems and policies, but also conduct cyberhygiene trainings for employees to raise their awareness of cybersecurity.
- Scrutinize and test patch installation processes
- Educate the security team on the latest methods used by cybercriminals.
The bottom line is that the work of CEHs can be extremely valuable. You need to put your investment in cybersecurity infrastructure, expertise, employee training, and all the rest to the test.
