As cyberattacks grow in sophistication, ethical hacking, or penetration testing, is the key to ensuring a secure cyber future. Regardless of the size of an organisation, all IT systems are vulnerable to cyberattacks. These can be from Internet-based viruses such as WannaCry, or internal breaches by employees. And if businesses want to avoid becoming a victim of such attacks, they need to hire a penetration tester. Penetration testing or ethical hacking In essence ethical hacking is an attempt to understand the nature of the cyberattack through vulnerability scanning and penetration testing. For a business person lacking IT and cyber security training, it’s useful to know the difference between vulnerability scanning and penetration testing. Vulnerability scanning identifies and reports on vulnerabilities in the IT system, while penetration testing is an attempt to breach those vulnerabilities through ethical hacking to see if malicious hacking is possible or has been carried out. Vulnerability scanning is recommended each quarter, for example, while penetration testing is recommended annually. Similarly, if vulnerabilities in the system are noted, a business should use a penetration tester to proceed with the hacking procedure. Identifying the target So the first task is to identify the target. Where is the vulnerability? Is it over the Internet or is it internal? Most hacking is indiscriminate. A hacker will have downloaded openware software on the Internet or possibly more sophisticated software from the dark web. Typically, a normal hacking tool will be set up to run overnight. That software will scan the Internet worldwide looking for vulnerable targets. The software finds IP addresses and tells them an IP has certain vulnerabilities. Meanwhile, with internal hacks the penetration tester monitors people who are behind possible security breaches within the organisation. This process can often by a cloak-and-dagger exercise involving snooping into the life of a possible hacker or using creative ways to breach a system to identify the culprit and the vulnerability. Rules of engagement for ethical hackers They look for all IP addresses and carry out a process called ‘kinging the IP’. Once the tester has a response from an IP, the penetration tester launches an attack on it. As ethical hackers, they have rules of engagement – so no stealing or destroying data. They find a critical vulnerability and start testing immediately. They then tell the client what they’ve found and only carry on to fix it once they are told to proceed. Following the ethical hack, the penetration tester will rate the vulnerabilities in the system from critical to low and write a report for each member of the board who can then decide on solutions going forward. The IT manager is then contacted and will decide on the resources needed to resolve the problem. The Internet of Things and cyber security As broadband and the Internet of Things become ever more pervasive in people’s lives, hacking will become equally more prevalent and sophisticated. So attacks can come through websites, mobile phones, wifi routers and now the Internet of Things, where everything in a business and at home is interconnected. SCC has a suite of cyber security products and experts who can ensure businesses stay as secure as is possible in the age of ransomware. An SCC security expert will visit a business and assess the cyber security risk prior to implementing one of a number of anti-malware solutions. For example, SCC uses a New Generation Firewall to monitor key indicators within a company’s network. After several days of gathering information, the business will receive a Cyber Threat Assessment Report and it will then be decided if a penetration test is necessary. Discover more about our Security Services
