‘Ethical’ hacking

• Publisher: Elsevier Science
• Year: 2001
• Tongue: English
• Weight: 166 KB
• Volume: 2001
• Category: Article
• ISSN: 1353-4858
• DOI: 10.1016/s1353-4858(01)01224-7

✦ Synopsis

Have you ever wondered how your security company gets its expertise? Think it's all down to hard work and research and diligent programmers working into the small hours trying to figure out how crackers minds work? Maybe, but just as likely, is that your security company is employing criminal hackers, albeit reformed ones, to give them the lowdown on IT security. If you are hiring a company to handle your security -or worse, if you are outsourcing the whole shebang -wouldn't you want to know if their key employees were blackhats turned corporate?

I did a straw poll recently and called a dozen IT security companies. On record, each claimed it did not and would not hire hackers to develop its security products and to watch the network. Hardly a surprise, would you want to invite an audit by the local police force, would you want your customers to know?

Next, I went underground and spent a few weeks talking to various "explorers"; they all told me the same thing: "we work for these guys you know, they need us". Which prompts the question: do you need to hire hackers to protect against hackers?

The ethical case for not hiring hackers, or ex-hackers goes something like this. If an individual is known to have knowledge that he or she could only have gained through breaking into systems, then that person is likely to be of the moral calibre that they will repeat their actions, either within or outside of a work situation. Don't believe that ethics matter? Well, next time you want to hire anyone, check out the local prison, it has lots of applicants who will be very interested. But that's not practical, is it? You don't want to hire thieves and miscreants. But this is exactly what you do each time you pay a hacker -whether it is for being good and debugging a virus, or developing probing tools. Sorry case closed! 'Ethical' hacking