- The noun 'hacker' refers to a person who enjoys learning the details of computer systems and stretch their capabilities.
- The verb 'hacking' describes the rapid development of new programs or the reverse engineering of already existing software to make the code better, and efficient.
- The term 'cracker' refers to a person who uses his hacking skills for offensive purposes.
- The term 'ethical hacker' refers to security professionals who apply their hacking skills for defensive purposes.
The term 'hacking' has over time gained negative repute and been associated with destructive or undesirable activities. Often it has been debated whether hacking can be ethical given the fact that any unauthorized access is a crime. In this discussion, we will first examine certain terms so that there is clarity regarding the various terms the reader may come across in the context of hacking.
- The noun 'hacker' refers to a person who enjoys learning the details of computer systems and stretches their capabilities.
- The verb 'hacking' describes the rapid development of new programs or the reverse engineering of already existing software to make the code better, and efficient.
- The term 'cracker' refers to a person who uses his hacking skills for offensive purposes.
- The term 'ethical hacker' refers to security professionals who apply their hacking skills for defensive purposes.
As computers gained a strategic role in the way businesses were conducted, enterprises leveraged their capabilities to conduct commerce. The advent of e-business was not without its inherent risks and problems. Organizations need to continually protect their virtual assets and presence. A number of web site defacements and denial of service attacks just moots this point.
Enterprises have begun to realize the need to evaluate their system for vulnerabilities and correct security lapses. The role of an independent security professional as examined in this context from an auditor's functionality brings out the need for ethical hackers. In fact, systems audit does incorporate a security evaluation to check for security lapses, though in a methodological manner with less scope for innovation or 'thinking out of the box'.
Crackers take pride in exploiting previously undetected vulnerabilities and hence, a methodological approach will not suffice. Enterprises need someone who can think like a cracker and probably simulate his actions, without doing damage or compromising confidentiality of information. This has seen the acceptance of a new genre of hackers - the 'ethical hackers'.
Ethical hacking is broadly defined as the methodology adopted by ethical hackers to discover the vulnerabilities existing in information systems' operating environments. Ethical hackers usually employ the same tools and techniques as criminal attackers, but they neither damage the target systems nor steal information, thereby maintaining the integrity and confidentiality of the systems. Their job is to evaluate the security of targets of evaluation and update the organization regarding the vulnerabilities of the discovered and appropriate recommendations to mitigate the same.
Security used to be a private matter. Until recently information security was something that was addressed by a handful of trained professionals. With the advent of e-business and the highly networked business scenario, security has become everyone's responsibility. The paradigm shift of technologically enabled crime has now made security everyone's business. Ethical hackers are professionals who are able to visualize this and respond to actual potential threats. This not only protects them from attacks but in the process does a lot of common good. The consequences of a security breach are so large that this volunteer proactive activity should not only be encouraged but also rewarded. This does not imply that a self proclaimed ethical hacker is better off doing his victims a 'favor'.
At present the tactical objective is to stay one step ahead of the crackers. The need of the hour is to think more strategically for the future. Social behavior, as it relates to computers and information technology, goes beyond merely adhering to the law since the law often lags behind technological advance.
The ethical question here is with regard to the physical activity. The physical activity of ethical hacking is sometimes hard to differentiate from cracking - it is hard to discern intent and predict future action - the main difference is that while an ethical hacker identifies vulnerabilities ( often using the same scanning tools as a cracker) the ethical hacker does not exploit the vulnerabilities while a cracker does. Until a social framework is developed to discern the good from the bad ethical hacking should not be condemned. Else, in our haste to condemn it, we might fail to exploit the goodness in talented people, thereby risking elimination of our last thin line of stabilizing defense.
COMMENTS