Distributed to Cybersecurity

Ethical Hacking: My Definition and Experience in the Field

Critical Role & Responsibilities of Ethical Hackers in Digital Transformation Initiatives. How to be an ethical hacker?

Purpose of this article

In this article, I create awareness of ethical hacking, its purpose, use cases, and a brief introduction to the role of ethical hackers in digital transformation initiatives.

My aim is to help security executives and managers choose the best ethical hackers for their businesses.

As a by-product, the information in this article can also guide aspiring ethical hackers to build their skills and plan their experiences.

Context

Ethical hacking is a critical function of the security and cybersecurity requirements of digital transformation initiatives. Every sizable digital transformation project requires at least one ethical hacker. Some massive programs may have multiple ethical hackers specializing in critical aspects and various domains of the program.

Background

Security, in a local sense, and cybersecurity in the connected world, touch every domain, solution construct, and building blocks of the solutions in digital transformation initiatives. To this end, there are critical requirements to leverage the skills and experience of ethical hackers in these initiatives.

One may ask what ethical hacking means, who ethical hackers are, what they do, why they do what they are supposed to do, and how they do them. These questions set the objectives of this article. I want to share my experience in the field. However, some points from my experience may conflict with traditional sources or textbooks.

In several previous articles, I introduced digital transformation initiatives under different subtopics. Instead of giving additional background on digital transformation, I’d refer you to one of my comprehensive articles. This article can provide you with useful background on digital transformation.

The primary use case for ethical hacking in digital transformation initiatives is to identify vulnerabilities in the systems and the solution building blocks. Identifying these vulnerabilities and addressing them in an agile manner requires deep security and cybersecurity expertise. The best talent to meet the requirements and expectations of the business stakeholders is ethical hackers.

Ethical hacking and ethical hackers in digital transformation initiatives

Ethical hackers are qualified technical specialists in the security and cybersecurity domains. These talented professionals have the required expertise, and they understand security domains such as authentication, authorization, accounting, and auditing functions in detail.

These are broad categories with many subcategories underneath. I only want to provide a high-level picture so that we focus on ethical hacking and ethical hackers as the primary objective of this article. While introducing the roles and responsibilities of ethical hackers in the following sections, I touch on some subcategories of security domains.

The difference between criminal and ethical hackers

Understanding the role and responsibilities of ethical hackers, can be useful; first, we know about criminal hackers. You probably heard a lot about criminal hackers in the media. They are the scary and bad guys with ill intentions.

Criminal hackers aim to steal data, information, knowledge, assets, and money. They may defame people. They can destroy systems, applications, and data. They can also blackmail people into gaining financial benefits. In short, they are into illegal activities. Criminal hackers are known as black hat hackers in the industry.

Whereas ethical hackers can support people and businesses, improve conditions, resolve situations, and prevent threats and vulnerabilities. They are known as white hat hackers.

In addition to these two types of hackers, there are also grey hat hackers who can be in between these two types. They are not as dangerous as criminal hackers but not as desirable as ethical hackers. The key difference is that grey hat hackers may access the systems without permission, but they do not necessarily mean harm. Some grey hat hackers have altruistic purposes.

After this brief background, let’s focus on ethical hackers.

Ethical hackers are an antidote to criminal hacking.

Ethical hackers are as knowledgeable and skillful as criminal hackers. In fact, some professional, ethical hackers are more knowledgeable and skilled than criminal ones. In the industry, ethical hackers are expected to outsmart criminal hackers. This quality is tested during the interviews using intricate questions, simulations, and using real-life scenarios.

Ethical hackers proactively monitor the systems, identify gaps, inform the stakeholders, create a plan of action, and help execute the plan.

Ethical hackers are equipped with various powerful security management tools. The most prominent tool set is the sniffer, also known as the packet analyzer. A packet analyzer is a software or hardware (appliance) program that can intercept the network and capture network traffic (as communication packets).

In addition to understanding the systems and solutions, ethical hackers also understand regulatory, safety, security, and industry compliance requirements. Digital products and services consumption by the public requires rigorous compliance review, auditing, and corrective actions.

I want to share the set of criteria that I developed in engaging ethical hackers in my digital transformation solutions. These criteria can help you understand the roles and responsibilities of ethical hackers in digital transformation solutions.

Let me point out a caveat here. These criteria may sound broader and more comprehensive than the traditional requirements. The rationale is there appear to be additional focus areas in transformative programs covering emerging technology stacks, extensive virtual platforms, Big Data, innovative and bespoke solutions, and critical non-functional requirements such as intricate interoperability, mobility, scalability, and capacity concerns.

How to be an ethical hacker?

In this section, I provide the criteria for becoming an ethical hacker in digital transformation programs. To make the criteria easy to read, I categorized the requirements under six broad categories:

1. Architecture, Design, & Industry Understanding, 2. Core Security Expertise, 3. Analytical Skills, 4. Technical Skills, 5. Interpersonal Skills 6. Business, Stakeholder, Project, and Organizational Skills.

1. Architecture, Design, & Industry Understanding

Even though ethical hackers are considered technical specialists, they also need to understand architecture, design, and governance schemes. These skills enable ethical hackers to understand requirements and architectural decisions, understand the architectural and design constraints, and interpret viability assessment work products.

Some key points are to understand the business process, consumption model, application landscape, data platforms, and practices.

Ethical hackers must know their specific industry details because the rules and regulations may vary in different industries.

In architecture phases (e.g., macro design), ethical hackers perform pragmatically. They can conduct quick experiments, proof of concept, and proof of technology in urgent solution delivery cases.

Ethical hackers participate in design authority and architecture review boards as security subject matter experts.

2. Security Expertise

From a specialty point of view, ethical hackers must have broad and deep demonstrated security and cybersecurity experience. Their security knowledge must be end-to-end and up-to-date.

They need to follow security news, development, and trends carefully. Global security awareness is a critical requirement for them. At the highest level, they need to know the theories and mechanisms for an end-to-end security requirements perspective in digital transformation programs.

Security architecture is a critical knowledge area for ethical hackers. They must have deep technical knowledge of security systems, security frameworks, security patterns, and the integration of security components.

Since encrypted messages on internetworks are critical in transforming business environments, ethical hackers must have a deep understanding of cryptography.

Social engineering is one of the most significant risks in business organizations. Social engineering is a widespread and the easiest way to exploit vulnerable users. Users’ lack of knowledge, social fear, confusion, and assumptions can create tremendous risks. Ethical hackers know how criminal hackers use social engineering to hack complex systems. They inform all stakeholders and educate the users not to fall into social engineering traps.

In addition, ethical hackers understand how the dark side of the Internet works. In digital transformation programs, the “darknet” or “darkweb” poses high risks and creates a huge fear for digital assets. To this end, ethical hackers inform the stakeholders and the users to take necessary measures and precautions to protect their assets proactively.

3. Analytical Skills

One of the fundamental roles of ethical hackers is to analyze systems, networks, solutions, applications, data, and databases. They can dive deep into analytical matters. They have a sharp eye for detail. They are observant and be able to see intricate and obscure patterns. They can perform the role of a security auditor in incident management teams.

4. Technical Skills

Programming (coding) and scripting skills are essential for ethical hackers. Some common languages are Python, C++, and Java. The language requirements may vary based on the program platforms. I used these three as an example.

Ethical hackers must possess core hacking techniques such as sniffing, scanning (e.g., W3af, Nessus, Burp), reverse engineering, disk/memory forensics, vulnerability analysis, frameworks such as Metasploit, and DoS attack. There are many more specialist hacking techniques, and those details are beyond the scope of this article.

Operating system knowledge is also essential. Some commonly used operating systems are Linux, Windows, Unix, ZoS, Android, macOS, iOS and other proprietary operating systems.

Networking and internet-working skills are critical. Ethical hackers need to understand network protocols, wireless protocols, architectures, frameworks, patterns, devices, functions, tools, connectivity, mobility, communications, and integration both in local and wide area networks.

As ethical hackers have to deal with data from many angles, understanding the data platforms, practices, storage, data lakes, data lifecycle management, databases, information, and knowledge systems. They also deal a lot with Big Data for special forensic investments.

Digital mobility knowledge is critical for ethical hackers. They understand the digital technologies, mobile networks, workflows in these mobile networks, protocols, and device relationships.

Ethical hackers have a broad understanding of the mechanisms and implications of emerging technology stacks such as IoT (Internet of Things), Cognitive Computing, Cloud Computing, Edge and Fog Computing, Artificial Intelligence, and Big Data Analytics.

5. Interpersonal Skills

One of the key distinguishing factors of ethical hackers is their caring, trustworthy, and reliable nature. Contrary to criminal hackers, ethical hackers have empathy and compassion for users. Ethical hackers are non-judgemental and can approach people with corrective actions. They are team players and mentors for other security professionals.

6. Business, Stakeholder, Project, and Organizational Skills

Ethical hackers need to have excellent stakeholder management skills. Some critical capabilities in this area are communicating at all levels and speaking the business language. They can articulate risks, issues, and dependencies both to technical and business stakeholders. While they can see the big picture, they are also capable of delving into details.

In large business organizations, ethical hackers work closely with project managers. Therefore, they understand the project methods and tools. They have a particular focus on agile methods as security and cybersecurity issues are usually considered emergency issues requiring expedited delivery with a priority number one approach.

Ethical hackers do not spend too long with root cause analysis during critical situations. They have to deal with incident management processes. During the incident management process, they must identify risks, issues, and dependencies very quickly.

They still need to provide input to the problem management team, but it happens after the priority incidents are resolved. Therefore a reasonable knowledge service management framework such as ITIL is desirable for ethical hackers.

They don’t have to know everything about service management as it is a broad domain. However, ethical hackers need to know how to elicit information and gain tacit knowledge by interacting with architects, specialists, project managers, and power users during the incidents. Event and configuration management are other areas they get involved in the service management domain.

Since the legal departments in digital transformation programs use ethical hackers, they also need to understand the legal issues, hacking implications, and other legal security concerns, and be able to speak effectively with legal professionals.

Sponsoring executives also require their lead ethical hackers to have an inventive and innovative mindset to contribute to their innovation agenda in their critical security initiatives such as Cloud security.

Certification Requirements for Ethical Hackers

I witnessed job applicants going for ethical hacking roles without certification. However, nowadays, it is a prerequisite to have recognized certification for ethical hackers. The certification covers knowledge, skills, competencies, and proven experience in the areas mentioned above.

The most popular and globally recognized qualification is provided by The International Council of Electronic Commerce Consultants (EC-Council). EC-Council provides a qualification called CEH (Certified Ethical Hacker). CEH is the most fundamental requirement for the certification of ethical hackers.

Other essential qualifications are Advanced Penetration Tester, Certified Network Defender, and Forensic Investigator provided by EC-Council. There are several other education and certification programs on the market, such as OSCP (Offensive Security Certified Professional), FUH (Foundstone Ultimate Hacking).

There are also many online training programs on ethical hacking technical skills. However, I haven’t come across a training program covering all aspects mentioned in the criteria I introduced in this article. The reason is, that the role of an ethical hacker is not merely knowledge-based but experience and expertise based.

Conclusions

Ethical hackers are critical security specialists and subject matter experts in digital transformation programs. They have an important mission in these programs. They possess unique skills, experience, and expertise.

I provided an overview of the knowledge, skills, competencies, and experience requirements of ethical hackers in digital transformation programs. The content in this article can guide security executives and managers to recruit qualified, ethical hackers for their business-critical initiatives in their programs.

Aspiring ethical hackers who plan to work in digital transformation programs can create a checklist and plan their path using the criteria. There is a tremendous demand for ethical hackers.

The field is rapidly developing, and there is not an adequate number of qualified, ethical hackers to meet the current market demands. I aim to create awareness of this topic by reflecting on my industry experience in the field.

You are welcome to join my 100K+ mailing list, to collaborate, enhance your network, and receive a technology newsletter reflecting my industry experience.

Thank you for reading my perspectives. I wish you a healthy and happy life.

If you are a new reader and find this article valuable, you might check my holistic health and well-being stories reflecting on my reviews, observations, and decades of sensible experiments.

Sample Health Improvement Articles for New Readers

I write about various hormones and neurotransmitters such as dopamine, serotonin, oxytocin, GABA, acetylcholine, norepinephrine, adrenaline, glutamate, and histamine.

One of my goals as a writer is to raise awareness about the causes and risk factors of prevalent diseases that can lead to suffering and death for a large portion of the population.

To raise awareness about health issues, I have written several articles that present my holistic health findings from research, personal observations, and unique experiences. Below are links to these articles for easy access.

Metabolic Syndrome, Type II Diabetes, Fatty Liver Disease, Heart Disease, Strokes, Obesity, Liver Cancer, Autoimmune Disorders, Homocysteine, Lungs Health, Pancreas Health, Kidneys Health, NCDs, Infectious Diseases, Brain Health, Dementia, Depression, Brain Atrophy, Neonatal Disorders, Skin Health, Dental Health, Bone Health, Leaky Gut, Leaky Brain, Brain Fog, Chronic Inflammation, Insulin Resistance, Elevated Cortisol, Leptin Resistance, Anabolic Resistance, Cholesterol, High Triglycerides, Metabolic Disorders, Gastrointestinal Disorders, and Major Diseases.

I also wrote about valuable nutrients. Here are the links for easy access:

Lutein/Zeaxanthin, Phosphatidylserine, Boron, Urolithin, taurine, citrulline malate, biotin, lithium orotate, alpha-lipoic acid, n-acetyl-cysteine, acetyl-l-carnitine, CoQ10, PQQ, NADH, TMG, creatine, choline, digestive enzymes, magnesium, zinc, hydrolyzed collagen, nootropics, pure nicotine, activated charcoal, Vitamin B12, Vitamin B1, Vitamin D, Vitamin K2, Omega-3 Fatty Acids, N-Acetyl L-Tyrosine, and other nutrients to improve metabolism and mental health.

Disclaimer: Please note that my posts do not include professional or health advice. I document my reviews, observations, experience, and perspectives only to provide information and create awareness.

I publish my lifestyle, health, and well-being stories on EUPHORIA. My focus is on metabolic, cellular, mitochondrial, and mental health. Here is my collection of Insightful Life Lessons from Personal Stories.

If you enjoy writing and storytelling, you can join Medium, NewsBreak, and Vocal as a creator to find your voice, reach out to a broad audience, and monetize your content.

You may also check my blog posts about my articles and articles of other writers contributing to my publications on Medium. I share them on my website digitalmehmet.com. Here is my professional bio. You can contact me via weblink.

As a writer, blogger, content developer, and reader, you might join Medium, Vocal Media, NewsBreak, Medium Writing Superstars, Writing Paychecks, WordPress, and Thinkers360 with my referral links. These affiliate links will not cost you extra to join the services.

You might join my six publications on Medium as a writer by sending a request via this link. 18K+ writers contribute to my publications. You might find more information about my professional background.

If you enjoy reading, you may join Medium with my referral link for limitless access to my stories and other writers.