CyberSecurity, Ethical Hacking, and Penetration Testing — Everything you need to know

Hello everyone. Wish you all a Happy 2024. In this article, we are going to see what is CyberSecurity and different types of Cyber Attacks. We will then look at Hacking and its different types. Later we will dive into Ethical Hacking and VAPT (Vulnerability Assessment and Penetration Testing). We will look into various techniques used in Penetration Testing like DAST, SAST, etc. We will conclude the article by looking at the differences between Ethical Hacking and Penetration Testing. Let's get started.

What is CyberSecurity?

Cyber Security is the practice of safeguarding computer systems, networks, and data from unauthorized persons or bots to ensure the reliability and security of digital systems. It comprises various Technologies, Tools, Controls, and Processes to prevent systems, networks, programs, devices, and data from Cyber Attacks done by Cyber Criminals or Hackers.

CIA Triad

The CIA triad is a common model that forms the basis for the development of security systems.

1. Confidentiality: To ensure that sensitive information is always protected from unauthorized access.
2. Integrity: To ensure that information is accurate, trustworthy, and not corrupted
3. Availability: Ensuring that the network/system is available to users always and everything is maintained safely

Types of CyberAttacks

There are various types of Cyber Attacks and some of the common ones are listed below. Even though new types of attacks are increasing, the old types of attacks like DDoS and Ransomware are still used by hackers to exploit the systems.

With the advent of IOT devices and their increased usage, IOT-based Attacks are increasing now.

Types of CyberSecurity

To mitigate the risk of different types of Cyber Attacks, there are different types of Cyber Security as follows. Cyber Security is not just about preventing an application or a network but about protecting the entire digital landscape like Endpoints, Cloud, IoT, Application, Network, and also the information.

What is Hacking?

The act of compromising digital landscapes through unauthorized access is generally referred to as Hacking. Hacking may not be malicious always but it is highly associated with Cyber Crime and the persons who hack the systems are called Hackers or Cyber Criminals.

There are 3 types of Hackers as shown above

Black Hat: They are the illegal hackers / Cyber Criminals who have bad intentions to hack the systems by making use of existing Cyber Attacks or by introducing a new type of attack

White Hat: White hat hackers are cyber security experts been given permission or certification to hack the systems. By doing so, they will explore the vulnerability in the system and they will be of good help to governments and organizations

Grey Hat: They are a mix of both Black and White Hat hackers. They might find vulnerabilities in the system without the permission of the organization and some organizations would disregard the Grey Hat hackers as they are not bound by Ethical hacking Policies. However, they do not have malicious intent like Black Hat Hackers.

What is Ethical Hacking

Ethical Hacking also called White Hat Hacking, involves authorized personnel who are experts in Cyber Security. They will understand the entire digital landscape of the organization and attempt to simulate cyber attacks on systems, applications, networks, etc. They use various techniques, tools, and methodologies to prevent the system from potential attacks.

VAPT — Vulnerability Assessment and Penetration Testing

Security Testing is one of the major roles and responsibilities of an Ethical Hacker in organizations. Though there are many types of Security Testing, the most commonly and widely used testing mechanism is VAPT which stands for Vulnerability Assessment and Penetration Testing. It is a technique to protect an organization against external and internal threats by identifying security threats using various tools and techniques.

Stages in Penetration Testing

1. Planning and Reconnaissance: The first stage of the Pen Test involves identifying goals and the scope. It also includes understanding the system and collecting data to understand the vulnerabilities.
2. Scanning: This step works on identifying the vulnerability of the systems using two ways namely —DAST and SAST which will be take a look in the next section.
3. Gaining Access: This step involves using web application attacks to simulate vulnerabilities like cross-site scripting(XSS), SQL injection, etc, and assess the damage.
4. Maintaining Access: To replicate real-world scenarios, Penetration Testers will try to maintain the system access for a long time using some backdoor entries and see how a hacker can exploit it. Persistent threats stay in the system for months and this step works to overcome such situations.
5. Analysis: A report has to be prepared and provided to the security team and it includes specific vulnerabilities, sensitive data access, access duration, and a few recommendations. Based on the reported issues, follow-up action will be taken to prevent the system.

Penetration Testing is generally recommended whenever there is a new application added or if the infrastructure is modified.

Scanning in Penetration Testing — DAST and SAST

We saw in Stage 3 about DAST and SAST. Now let's look at this in detail

DAST — Dynamic Application Security Testing

Dynamic analysis sees the application’s code in a running state to get a real-time perspective and various tools are used to perform the Dynamic scan. DAST is also called Black Box testing as there is no visibility on the source code for the Penetration Tester. Some common tools used for DAST are listed below

Advantages of DAST

• Real World Simulation
• Comprehensive Coverage
• Effective for Web Applications
• External Perspective of a Hacker

SAST — Static Application Security Testing

Static Analysis involves identifying the vulnerabilities in the source code. SAST is performed in the SDLC cycle of Software Development and hence the vulnerabilities can be identified even before the application is released. It is also called White Box texting as there is visibility on the source code for the Penetration Tester. There are various tools to perform Static Code Analysis as follows

Advantages of SAST

• Early detection of vulnerability
• Complete Code Analysis
• Integration into SDLC
• Reduced False Positives when compared to Dynamic Testing

Comparison between Ethical Hacking and Penetration Testing

Having seen Ethical Hacking and Penetration Testing in detail, the following table will give a clear idea of the differences between them.

Summary

In this article, we saw about CyberSecurity and different types of Cyber attacks. We then looked at Hacking and its different types. Later we did a deep dive into Ethical Hacking and VAPT (Vulnerability Assessment and Penetration Testing). We then looked into various techniques used in Penetration Testing like DAST, SAST, etc. We have concluded the article by looking at the differences between Ethical Hacking and Penetration Testing.

Hope you liked this article and thanks for reading this!!!

If you like to get more updates from me, 
please follow me on Medium and subscribe to the email alerts.