Ethical hacking Chapter 1 - Overview - Eric Vanderburg
Download as PPTX, PDF2 likes1,096 views
The document discusses ethical hacking and the role of ethical hackers. Ethical hackers are employed by companies to perform penetration tests to find vulnerabilities in a company's network. There are different penetration testing models like white box, black box, and gray box. Security testers can earn certifications from programs like CEH, CISSP, and OPST. Ethical hackers must understand what activities are legally allowed like penetration testing and what are not, such as installing viruses, as laws vary by location. It is important for ethical hackers to have a contract in place when performing security tests for a company.
More Related Content
What's hot (20)
Similar to Ethical hacking Chapter 1 - Overview - Eric Vanderburg (20)
More from Eric Vanderburg (20)
Recently uploaded (20)
Ethical hacking Chapter 1 - Overview - Eric Vanderburg
- 1. Ethical Hacking CHAPTER 1 – OVERVIEW ERIC VANDERBURG
- 2. Objectives Describe the role of an ethical hacker Describe what you can do legally as an ethical hacker Describe what you cannot do as an ethical hacker
- 3. Introduction to Ethical Hacking Ethical hackers Employed by companies to perform penetration tests Penetration test Legal attempt to break into a company’s network to find its weakest link Tester only reports findings Security test More than an attempt to break in; also includes analyzing company’s security policy and procedures Tester offers solutions to secure or protect the network
- 4. The Role of Security and Penetration Testers Hackers Access computer system or network without authorization Breaks the law; can go to prison Crackers Break into systems to steal or destroy data U.S. Department of Justice calls both hackers Ethical hacker Performs most of the same activities but with owner’s permission
- 5. The Role of Security and Penetration Testers (cScoriptn kidtdiniesu ore padck)et monkeys Young inexperienced hackers Copy codes and techniques from knowledgeable hackers Programming languages used by experienced penetration testers Practical Extraction and Report Language (Perl) C Script Set of instructions that runs in sequence
- 6. The Role of Security and Penetration Testers (cTigoer nbotxinued) Collection of OSs and hacking tools Helps penetration testers and security testers conduct vulnerabilities assessments and attacks
- 7. Penetration-Testing Methodologies White box model Tester is told everything about the network topology and technology Tester is authorized to interview IT personnel and company employees Makes tester job a little easier Black box model Company staff does not know about the test Tester is not given details about the network Burden is on the tester to find these details Tests if security personnel are able to detect an attack
- 8. Penetration-Testing Methodologies (continued) Gray box model Hybrid of the white and black box models Company gives tester partial information
- 9. Certification Programs for Network Security Personnel Certification programs available in almost every area of network security Other certifications that help prepare for these certifications CompTIA Security+ Network+
- 10. Certified Ethical Hacker (CEH) Developed by the International Council of Electronic Commerce Consultants (EC-Council) Based on 21 domains (subject areas) Web site www.eccouncil.org Red team Conducts penetration tests Composed of people with varied skills
- 11. OSSTMM Professional Security Tester (OPST) Designated by the Institute for Security and Open Methodologies (ISECOM) Based on the Open Source Security Testing Methodology Manual (OSSTMM) Written by Peter Herzog Consists of 5 domains Web site www.isecom.org
- 12. Certified Information Systems Security Professional (CISSP) Issued by the International Information Systems Security Certifications Consortium (ISC2) Usually more concerned with policies and procedures Consists of 10 domains Web site www.isc2.org
- 13. SANS Institute SysAdmin, Audit, Network, Security (SANS) Offers certifications through Global Information Assurance Certification (GIAC) Top 20 list One of the most popular SANS Institute documents Details the most common network exploits Suggests ways of correcting vulnerabilities Web site www.sans.org
- 14. What You Can Do Legally Laws involving technology change as rapidly as technology itself Find what is legal for you locally Laws change from place to place Be aware of what is allowed and what is not allowed
- 15. Laws of the Land Tools on your computer might be illegal to possess Contact local law enforcement agencies before installing hacking tools Written words are open to interpretation Governments are getting more serious about punishment for cybercrimes
- 16. Is Port Scanning Legal? Some states deem it legal Not always the case Federal Government does not see it as a violation Allows each state to address it separately Read your ISP’s “Acceptable Use Policy” IRC “bot” Program that sends automatic responses to users Gives the appearance of a person being present
- 17. Federal Laws Federal computer crime laws are getting more specific Cover cybercrimes and intellectual property issues Computer Hacking and Intellectual Property (CHIP) New government branch to address cybercrimes and intellectual property issues
- 18. What You Cannot Do Legally Accessing a computer without permission is illegal Other illegal actions Installing worms or viruses Denial of Service attacks Denying users access to network resources Be careful your actions do not prevent customers from doing their jobs
- 19. Get It in Writing Using a contract is just good business Contracts may be useful in court Books on working as an independent contractor The Computer Consultant’s Guide by Janet Ruhl Getting Started in Computer Consulting by Peter Meyer Internet can also be a useful resource Have an attorney read over your contract before sending or signing it
- 20. Ethical Hacking in a Nutshell What it takes to be a security tester Knowledge of network and computer technology Ability to communicate with management and IT personnel Understanding of the laws Ability to use necessary tools
- 21. Summary Companies hire ethical hackers to perform penetration tests Penetration tests discover vulnerabilities in a network Security tests are performed by a team of people with varied skills Penetration test models: White box model Black box model Gray box model Security testers can earn certifications
- 22. Summary (continued) Certifications CEH CISSP OPST Sans Institute Be aware of what you are legally allowed or not allowed to do Laws change from place to place ISPs usually have an “Acceptable Use Policy”
- 23. Summary (continued) State and federal laws should be understood before conducting a security test Get it in writing Use a contract Have an attorney read the contract