Ethical hacking explained
Ethical hacking is typically an authorized attack on a system in order to determine flaws and vulnerabilities which could lead to unauthorized access of company data and assets if the flaws are not properly patched. An ethical hack typically comes from white hat hackers, skilled professionals who will attack company networks and infrastructure, but they do not do so maliciously.
Ethical hacking is typically performed with the express authorization of the company, but there are some ethical hackers that attack company networks in an attempt to show the company that their networks are vulnerable. This type of attack has mixed results, as some companies are happy that vulnerabilities were exposed before a malicious attacker was able to expose them while other companies regard this type of hacking as completely illegal. However, some ethical attackers have actually gained jobs from using their hacking exploits. But to be safe, all ethical hacking should be performed with authorization—many malicious attackers claim to be ethical hackers once they are caught, and many ethical hackers that actually are attempting to warn a company of vulnerabilities in their infrastructure may be prosecuted.
Hacktivism has long been debated as to whether it is ethical hacking or not. Hacktivists typically attack company networks in order to make a political point or call attention to injustice. Many of the victims of hacktivists are not accepting of the hacktivists' efforts, and this has resulted in much debate over hacktivism and ethical hacking.
Why companies use ethical hacking
Companies use the services of ethical hackers to determine just how secure their company network security is, and whether there are areas that need to be patched and properly secured. The best way to determine this is to hire the services of a skilled, professional hacker that can perform the same kind of attack that a malicious hacker would attempt. If the ethical hacker finds any vulnerabilities or weaknesses, he can inform the company and the proper actions can be taken to secure the vulnerable area.
The penetration test
The ethical hacker will use a penetration test in order to find errors and vulnerabilities in software code which could potentially lead to compromised company data, user accounts, client and customer financial information, application functionality, etc. This test will consist of the use of several tools (typically network scanners), as well as the use of the hacker's skill and knowledge in order to perform the same type of attack the company can expect from a skilled malicious hacker.
Ethical hacking tools
Ethical hackers typically have a wide variety of tools available for use in a penetration test against a company network. Some of these tools are automated, others must have some input from the hacker. The types of tools used depend on the type of network security the company has implemented. Some of the tools will perform static analysis and dynamic analysis in order to best find vulnerabilities in application code such as flawed encryption and malicious code.
