My question today come from my homework question from class ethics in IT.
Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities in the system. Hackers would take a role in finding out what's wrong with security and alarm company what need to patched. But, I find myself uneasy on criminal record of such hackers. What should I do, and what are ethical issue about this problem.
Well, my thoughts about it at first is to say no. There are many companies which could do same thing as hackers could do. Security companies would be more expensive, but hacker have their own knowledge on underground hacking.
The problem with (some) hackers is that their record even though it points that they been using their knowledge to do unethical things but can't be overlooked because what they can do for companies. Checking on their background is a must. Also checking on their achievements in security training should be done also, and find out how much they learned and if they could be trusted.
In my opinion its all about the trust in the hacker, who unknowingly could install a back door in the company.
Well that's roughly my thoughts. So should hackers/crackers be hired for penetration testing? Or it is too much of a risk, and companies well known for security testing should be hired instead?