Cybersecurity III: Ethical Hacking and Penetration Testing-ss2 note
CYBERSECURITY III: ETHICAL HACKING AND PENETRATION TESTING
Class: SSS 2
Term: Third Term
Week: 6
Topic: Cybersecurity III
Duration: 80 Minutes (Double Period)
Learning Objectives
By the end of the lesson, students should be able to:
- Explain the meaning of ethical hacking.
- Define penetration testing.
- Identify the differences between ethical hacking and malicious hacking.
- Describe the basic stages of responsible security testing.
- State rules and precautions for conducting security tests responsibly.
1. Introduction to Ethical Hacking
Computers, mobile devices, websites and networks store and process important information. If these systems are not properly protected, unauthorised people may gain access, steal information, damage files or interrupt services.
Cybersecurity involves protecting digital systems, networks and information against unauthorised access, misuse and damage. One way organisations improve their security is by allowing authorised professionals to examine their systems for weaknesses.
This practice is known as ethical hacking. It helps organisations discover security problems and correct them before malicious individuals exploit them.
2. Meaning of Ethical Hacking
An ethical hacker uses cybersecurity knowledge and approved testing methods to find vulnerabilities. The person works within agreed rules and reports findings to the system owner so that weaknesses can be corrected.
Ethical hacking is sometimes called white-hat hacking. The term refers to hacking activities carried out with permission and for a legitimate security purpose.
2.1 Who Is an Ethical Hacker?
An ethical hacker is a person who has permission to test a digital system and helps its owner improve security.
Ethical hackers may work for:
- Banks and financial institutions.
- Government agencies.
- Schools and universities.
- Technology companies.
- Hospitals and other organisations.
- Cybersecurity consulting firms.
2.2 Why Is Ethical Hacking Important?
- It helps identify security weaknesses before criminals exploit them.
- It helps organisations improve their security controls.
- It can reduce the risk of data theft and service disruption.
- It helps organisations understand their security risks.
- It supports the protection of confidential information.
- It can help organisations meet relevant security requirements.
3. Meaning of Penetration Testing
Penetration testing is commonly shortened to pen testing. It helps an organisation understand whether a security weakness could allow an attacker to gain unauthorised access or perform an unwanted action.
For example, a school may hire a qualified security tester to assess its school website. The tester works within an agreed scope, identifies weaknesses and provides a report explaining how the school can improve its security.
3.1 Difference Between Ethical Hacking and Penetration Testing
The terms are closely related, but they are not exactly the same. Ethical hacking is a broad term for authorised security activities, while penetration testing is a more structured assessment designed to test and demonstrate specific security weaknesses.
| Ethical Hacking | Penetration Testing |
|---|---|
| A broad activity involving authorised attempts to identify and help correct security weaknesses. | A planned test that assesses whether selected weaknesses can be exploited. |
| May include security reviews, vulnerability assessments and other approved security tasks. | Usually follows a defined scope, testing plan and reporting process. |
| May involve several methods of improving system security. | Focuses on evaluating the security of specified systems or applications. |
4. Basic Stages of Penetration Testing
Professional penetration testing should follow an agreed process. The exact steps depend on the system and the purpose of the test.
4.1 Planning and Permission
The tester obtains written authorisation, identifies the systems to be tested and agrees on the activities that are allowed.
4.2 Information Gathering
The tester collects approved information about the system, such as its publicly available services, software versions and general structure.
4.3 Identifying Vulnerabilities
The tester examines the system for possible weaknesses, such as outdated software, weak access controls or security misconfigurations.
4.4 Controlled Testing
Within the agreed scope, the tester checks whether selected weaknesses can be exploited. Testing should be carefully controlled to avoid unnecessary damage, service interruptions or exposure of private information.
4.5 Reporting Findings
The tester documents the weaknesses discovered, their possible effects and the evidence needed to explain the findings.
4.6 Fixing and Retesting
The system owner corrects the identified weaknesses. The tester may then perform an approved retest to check whether the corrections have worked.
5. Ethical Hacking and Malicious Hacking
Not everyone who attempts to access a computer system has good intentions. The difference between ethical hacking and malicious hacking includes permission, purpose, methods and the handling of information.
Malicious hackers may be described as black-hat hackers. They may act for financial gain, personal revenge, espionage or other harmful purposes.
| Feature | Ethical Hacking | Malicious Hacking |
|---|---|---|
| Permission | Performed with appropriate authorisation. | Performed without permission or outside the permission granted. |
| Purpose | To identify weaknesses and improve security. | May aim to steal data, commit fraud, cause damage or gain unauthorised benefits. |
| Handling of information | Protects confidential information and reports findings responsibly. | May steal, expose, misuse or destroy information. |
| Scope | Works within agreed limits and rules. | Ignores the owner's rights or agreed restrictions. |
| Outcome | Helps the owner correct security weaknesses. | Can cause financial loss, privacy violations or service disruption. |
Examples
Example 1 — Ethical hacking: A company gives a security professional written permission to test its website. The professional finds a weakness, records the evidence safely and reports how it can be fixed.
Example 2 — Malicious hacking: A person breaks into another person's email account without permission and uses private messages to threaten the owner.
Example 3 — Testing beyond permission: A student is authorised to test a practice website but decides to attack the school's live network as well. The extra activity is unauthorised, even if the student claims to be learning cybersecurity.
6. Responsible Security Testing
Responsible security testing means examining systems in a lawful, careful and professional manner. A security tester must respect the system owner's instructions, the privacy of users and the safety of the system.
6.1 Obtain Permission
Always obtain clear authorisation from the owner or an authorised representative before testing a system.
6.2 Define the Scope
Agree on the systems, accounts, dates, methods and activities that may be tested. Do not test other systems simply because they are connected to the approved target.
6.3 Protect Private Information
Avoid unnecessary access to personal information. Any information encountered during testing should be handled securely and shared only with authorised people.
6.4 Avoid Unnecessary Damage
Do not delete files, change important settings, interrupt services or run destructive tests unless they are explicitly authorised and safely planned.
6.5 Keep Accurate Records
Document the tests performed, the weaknesses discovered and the steps taken. Accurate records help the system owner understand and correct the problems.
6.6 Report Weaknesses Responsibly
Report security findings to the appropriate person or organisation. Do not publish sensitive details or use a weakness to threaten the owner.
6.7 Follow Laws and Professional Rules
Security testers must obey applicable laws, organisational policies and professional standards. They should ask for guidance when the permitted activities are unclear.
6.8 Use Safe Practice Environments
Students should practise using purpose-built cybersecurity labs, classroom demonstrations or systems for which explicit permission has been granted.
7. Skills and Qualities of an Ethical Hacker
An ethical hacker needs technical knowledge as well as responsible behaviour. Important skills and qualities include:
- Networking knowledge: Understanding how computers communicate over networks.
- Operating system knowledge: Understanding the basic operation and security of computer systems.
- Problem-solving: Analysing systems carefully to identify possible weaknesses.
- Attention to detail: Observing small configuration errors and recording findings accurately.
- Communication: Explaining technical problems clearly in reports and discussions.
- Honesty: Reporting findings accurately without exaggeration.
- Respect for privacy: Protecting confidential data encountered during testing.
- Knowledge of rules: Understanding the limits of the permission granted.
8. Benefits of Ethical Hacking and Penetration Testing
- Helps organisations discover security weaknesses.
- Supports the protection of personal and business information.
- Helps assess the effectiveness of existing security controls.
- Provides information for improving system configurations and policies.
- Can reduce the risk of certain cyberattacks when findings are corrected.
- Encourages responsible cybersecurity practices.
However, no single test can guarantee complete security. Systems change over time, and new weaknesses may appear. Security testing should be part of an ongoing protection programme.
9. Class Activity
Activity: Ethical or Malicious?
Read each situation and decide whether it describes ethical hacking, malicious hacking or testing outside the approved scope.
- A school gives a qualified tester permission to check a practice website and report weaknesses.
- A student guesses a classmate's password and reads private messages without permission.
- A company authorises a test of its training server, but the tester also attacks its payment server without permission.
- A security tester documents a weakness and privately reports it to the system owner.
Expected discussion:
- Situation 1: Ethical hacking.
- Situation 2: Malicious or unauthorised activity.
- Situation 3: Testing outside the approved scope.
- Situation 4: Responsible security reporting.
Students should explain their decisions by referring to permission, purpose, scope and the handling of information.
10. Summary
Ethical hacking is the authorised examination of computer systems and networks to identify security weaknesses and help improve protection. Penetration testing is a structured security assessment that checks whether selected weaknesses can be exploited.
Ethical hacking differs from malicious hacking because it requires appropriate permission, follows agreed limits and aims to improve security. Responsible security testing involves obtaining authorisation, defining the scope, protecting private information, avoiding unnecessary damage and reporting findings properly. Students should practise only in approved environments.
11. Evaluation Questions
- Define ethical hacking.
- What is penetration testing?
- State three differences between ethical hacking and malicious hacking.
- List four basic stages of penetration testing.
- Why is permission necessary before conducting a security test?
- Mention five rules for responsible security testing.
- State four skills or qualities of an ethical hacker.
- Explain why testing a system outside the approved scope is wrong.
12. Assignment
Answer the following questions in your notebook:
- Explain the meaning of ethical hacking and penetration testing.
- Prepare a table showing five differences between ethical hacking and malicious hacking.
- Describe six precautions that should be followed during responsible security testing.
- Give two examples of safe environments in which students can learn cybersecurity.
13. Interactive Revision Quiz
Choose the correct answer for each question and click Mark Quiz to see your score.
Comments
Post a Comment