Understand what makes hackers tick – then you can decide on the best approach.

Cybersecurity professionals see some threat actors or outside-parties as the enemy. However, challenging this mindset is important; you can do a better job protecting your organization against outside-parties if you understand how they think and operate.

With this in mind, businesses around the globe have turned to hackers to test security infrastructure and develop stronger, more robust security practices.

However, before integrating this penetration testing into your security policy, it is important to understand that not just any hacker(s) will work. Many different types of hackers exist, each with its own motivations. You must be clear about which group’s skills can be used to your organization’s advantage.

Black hat

Black hat hackers are cybercriminals motivated by personal or financial gain. They range from teenage amateurs to experienced individuals or teams with a specific remit. However, over recent years, several high-profile blackhat hackers have refocused their cyber skills to protect organisations. An example is Kevin Mitnick aka Condor, who was just sixteen years old when he gained access to a Department of Defense computer.  Following this and numerous other hacks, Mitnick spent five and a half years in prison. Upon his release set up his own company to run penetration tests for clients.

The issue of whether to work with a previous black hat hacker is a contentious one. Some, including David Warburton, senior threat evangelist at F5 Networks, believes that hiring ex-hackers is critical in staying ahead of the threat landscape. However, others are concerned about allowing this group access to corporate systems and customer data. The latter group should, however, consider other approaches to working with hackers. 

White hat

Often referred to as ‘ethical’ hackers, white hat hackers are employed by organizations to look for vulnerabilities in security defences. Despite using the same tactics as black hat hackers, this group has permission from the organization, making what they do entirely legal. While they use their knowledge to find ways to break the defences, they then work alongside security teams to fix issues before others discover them.

Many of the biggest organisations in the world, including General Motors and Starbucks, are turning to white hat hackers to help identify fault lines and proactively enhance security posture. White hat hacking can offer an interesting and lucrative career path for people with technical skills. Drawing attention to the important role that white hat hackers play can encourage more talented individuals to take a positive path instead of becoming black hat hackers.

Nurturing talent

There are many programs in place to find, encourage and support the next generation of white hat hackers. An example, supported by AWS, is r00tz Asylum, a conference dedicated to teaching young people how to become white-hats. Participants learn how hackers operate and how cybersecurity experts defend against hackers. The aim is to encourage people with technical expertise to use it for good in their career. By equipping aspiring cybersecurity professionals with knowledge and skills, security can be baked into infrastructure from the ground up. This is AWS’s stated aim of giving back to society by addressing the next generation and providing young people with a safe learning environment and access to mentors.

Easing the security hardening process

For those responsible for maintaining customer trust and protecting data, an end-to-end approach to security is critical. As we have seen, working with ethical hackers is a powerful way to view security posture from a cyber-criminal’s perspective to identify and tackle vulnerabilities. However, it is also important to remember that security needs to be baked in throughout an organisation’s infrastructure.

This is where partnering with a cloud platform can be beneficial; the best of these are developed to satisfy the needs of the most risk-sensitive organisations. Cloud platforms also offer automated security services, which can proactively manage security assessments, threat detection, and policy management. With such infrastructure in place, much of the heavy lifting can be made easier for security professionals and hired hackers.

More on ethical hacking: https://cybersecasia.net/?s=white+hacker