Ethical Hacking
Computer Ethics – CIS 324
Dr. Nelson Stewart
June 7, 2013

INTRODUCTION
When most people hear the term “hacker” they think of an evil person committing crimes by hacking into their computers to steal, destroy and/or steal identities. This is so in some cases, but not all hackers are bad. Hackers are merely curious technically skilled individuals who gain unauthorized access to computers, networks of various companies, organizations and individuals. Good hackers are considered white hat hackers. They are the ones that are hired to break into systems as a way of testing the vulnerabilities and security issues that may be present in the computer system. Bad hackers are considered black hat hackers. They are the “evil” hackers, or should I say “crackers” who hack into systems to steal identities, information, crack into software programs and create nasty viruses.
What is Ethical Hacking?
Ethical hacking provides a way to determine the security of an information technology environment – at least from a technical point of view. As the name ethical hacking already tells, the idea has something to do with hacking. But what does “hacking” mean? The word hacking has two definitions. The first definition refers to the hobby/profession of working with computers. The second definition refers to breaking into computer systems. While the first definition is older and is still used by many computer enthusiasts (who refer to cyber-criminals as “crackers”), the second definition is much more commonly used.”
Ethical hackers attack and penetrate systems and networks in order to discover points of weaknesses. The government along with many businesses has taken drastic steps to better secure their networks by using ethical hackers. Ethical hackers are people who have a vast technical knowledge about operating systems and computer networks. The only difference between a ethical hacker and a “real” hacker or blackhat, is that the ethical hacker (white hat) uses their knowledge on how to hack a system in an ethical way. Some ex-hackers have been hired by companies as an ethical hacker but there is a lot of controversy on whether ex-hackers should be given access to highly sensitive information and if they are trustworthy.
In the movie, Live Free or Die Hard, a former Department of Defense agent, Thomas Gabriel, sets out to shut down and sell access to America’s infrastructure – hence term “fire sale.” He begins by attacking America’s infrastructure by disrupting transportation, communication and crashing the Stock Market. His intention is to prove that the security in place was vulnerable and could be easily compromised and of course to be compensated for the embarrassment from being fired. Although this has never happened and it’s Hollywood fiction, this scenario could be a possibility in the very near future with today’s technology. Using an ethical hacker in this scenario could determine if there were any weaknesses in the infrastructure and how to fix them so that the system isn’t compromised. One of the first examples of ethical hackers at work was in the 1970s, when the United States government used groups of experts called red teams to hack its own computer systems. According to Ed Skoudis, Vice President of Security Strategy for Predictive Systems’ Global Integrity consulting practice, ethical hacking has continued to grow in an otherwise lackluster IT industry, and is becoming increasingly common outside the government and technology sectors where it began. Many large companies, such as IBM, maintain employee teams of ethical hackers.
Pros and Cons of Ethical Hacking
As with anything, there are some advantages and disadvantages to ethical hacking.
Many security-researcher hackers are very scornful of big software companies both because of the large number of security flaws in their products and because they are slow to plug leaks even when they know of them. The hackers argue that businesses do not behave responsibly toward the public. Publicizing security problems spurs the companies to take action. This argument has some truth to it. Many system operators do not close loopholes, even well-publicized ones, until there is a break-in. Hackers and security consultants say they repeatedly warn companies of flaws that allow access by hackers, but the companies do not respond until hackers exploit the flaws and cause significant problems. (Basse, 2008)
Apple recently had a security breach in their system. A small amount of its employees’ computers had been hacked but according to Apple, there was no evidence of data being exposed. Apple discovered the problem in the Java patch for the OS.X software. In the end, it was determined that the security hole was actually in Oracle’s Java software which was responsible for a number of recent attacks.
Conclusion
In 2007 Scott Lunsford was told that it was impossible to hack into a nuclear power station using the Supervisory Control and Data Acquisition software (SCADA). SCADA is a popular software program used around the world for infrastructure such as water, transportation, and water filtration systems. Scott was able to hack into the nuclear power station with little or no effort stating that the vulnerabilities in the system made it easy and it was the easiest hack job he had ever done.
There are some who do not believe that ethical hacking is a good thing and that once a hacker always a hacker. For instance, Parmy Olson argues that it doesn’t seem logical to refer to someone as an “ethical hacker” because he or she has moved over from the dark side “into the light,” It just makes them a bad hacker. She also believes that the term “ethical” hacker, means someone who is good at breaking into things by using creative techniques and methods but without the criminal intention. (Olson, 2012).
In many cases, when a system is hacked into generally it is not known until after the fact. Even with all the modern up-to-date security measures in place, hacking is basically unavoidable. Tougher laws in place may help deter or at least decrease the amount of hacking that takes place. Educating others in security and regular maintenance of their system could dramatically reduce the number of hacking incidences.
“Ethical hacking” seems to be a new buzz word although the techniques and ideas of testing security by attacking an installation aren’t new at all. Administrators tested their systems already decades ago and even discussed their ideas and findings in public. Nevertheless, ethical hacking provides results which can be used to strengthen a information technology environments security nearly immediately. The revealed vulnerabilities and problems may lead to a successful compromise of one or multiple systems – ethical hacking provides data which is based on real tests, which have been successful after all. An ethical hack per se doesn’t fix or improve the security at all—it does provide information about what should be fixed.
References
Basse, S. (2008). A Gift of Fire: Social Legal and Ethical Issues for Computing and the Internet. (3rd ed.). Upper Saddle River, NJ: Pearson.
Kelly, Heather. (2013). “Apple: We were hacked, too.” Retrieved from http://www.cnn.com/2013/02/19/tech/web/apple-hacked. Accessed on June 7, 2013.
SANS Institute. (2003) “Global Information Assurance Certification Paper”. Retrieved from http://www.giac.org/paper/gsec/2468/ethical-hacking/104292. Accessed May 24, 2013.
Wang, Wally. (2000) “Steal This Computer Book: What They Won’t Tell You About The Internet.” No Starch Press; 2nd edition (January 15, 2000).
Retrieved from http://www.iss.net/security_center/advice/Underground/Hacking/default.htm. Accessed May 24, 2013.
Retrieved from http://searchsecurity.techtarget.com/definition/ethical-hacker. Accessed May 24, 2013.
Retrieved from http://www.sudohacks.com/2012/12/pros-cons-of-ethical-hacking.html. Accessed on June 7, 2013.