# Penetration testing by ethical Hackers/Crackers should be trusted?

My question today come from my homework question from class ethics in IT.

Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities in the system. Hackers would take a role in finding out what's wrong with security and alarm company what need to patched. But, I find myself uneasy on criminal record of such hackers. What should I do, and what are ethical issue about this problem.

Well, my thoughts about it at first is to say no. There are many companies which could do same thing as hackers could do. Security companies would be more expensive, but hacker have their own knowledge on underground hacking.

The problem with (some) hackers is that their record even though it points that they been using their knowledge to do unethical things but can't be overlooked because what they can do for companies. Checking on their background is a must. Also checking on their achievements in security training should be done also, and find out how much they learned and if they could be trusted.

In my opinion its all about the trust in the hacker, who unknowingly could install a back door in the company.

Well that's roughly my thoughts. So should hackers/crackers be hired for penetration testing? Or it is too much of a risk, and companies well known for security testing should be hired instead?

• -1 you are asking this question like you have an alternative. Either you pay good money to have a very skilled hacker tell you how to fix the flaws, or you get 0wn3d by the mob. – rook Sep 15 '11 at 4:36
• There are always alternatives. Pentesting firms hire really good hackers, but not (usually at least) convicted criminal hackers. – efr4k Sep 15 '11 at 7:16
• -1 for "homework help" and subjectivity. – Iszi Sep 15 '11 at 13:38
• And sorry, can't vote for best answer only because you all brought some good points. :) – HelpNeeder Sep 15 '11 at 18:18

There are a few drawbacks to hiring a blackhat "hacker" instead of a security company.

They are harder to trust

Apart from backdooring your system, I would not trust a blackhat I pick off the street to keep his findings about my network confidential. Hackers like to boast to their peers. The knowledge they obtain about your security can bite you in the ass in more than one way.

OK, that's a bit strong. But a hacker who is just in it for the fun and not for the money, will focus on what he finds fun. I have worked with both professional penetration testers and "recreational hackers", and the latter kind performs a different kind of test. If you find yourself a good hacker, he may have more knowledge than the professional penetration tester, but he will not deliver the same quality report. He will find a fun way to enter your network and exploit that fully, while the penetration tester will see if there are multiple ways in, will weigh the issues he finds against the actual risk, and can give you a less black-and-white advice about how to solve the issues.

They are harder to do business with

Think in terms of planning, deadlines, availability for status updates et cetera.

So, if you find yourself the perfect gentleman hacker with knowledge of the underground, who will keep your findings confidential, propose realistic solutions, and do the test from the perspective of what is useful to you instead of just what is fun for him, then you have a winner. Good luck finding him :-)

By the way, if you already have a security company you hire for regular penetration tests and such (which imho a big company should have), then hiring some hackers for an extra'' test to see if the company misses anything, can be a great move. The confidentiality issue stays though...

• I find your answer very appalling. It seems that points you posted are very clear. I also always understood that good and ethical hackers are people who don't involve in crimes, they instead, are gaining knowledge for their own purpose. Wisdom. – HelpNeeder Sep 15 '11 at 18:15
• The problem is that hackers come in many flavors. It's up to you to distinguish between them, whereas in the case of a security company, they have done that. Therefore I assume the worst about a random hacker. – chris Sep 15 '11 at 18:46

I have worked as a solo security consultant, hired and vetted security testers, sat on the standards committee for CREST (the UK gold standard in penetration testing) and managed security teams of up to 100 people so I have a pretty broad experience of how this works.

Risks

• An attacker goes "rogue" - having a contract with an established, reputable company provides you with two things: evidence that you have minimised your risk (the 'due diligence' piece for the board) and contractual leverage to be reimbursed for losses, which might be difficult if the hacker ran off with your millions.

• The "hacker" is unavailable (run over by a bus, ill etc) - your big business needs to know the job will get done. You can't get that level of "trust" with a sole trader, whereas a big team should be able to move resource around to help deliver.

• Do you limit what the penetration tester can do? If you give them more access than your own staff, shouldn't you be vetting them at a higher level than your own staff? You should assure yourself that their data storage is secure (as they may have very sensitive data about your company's vulnerabilities), that their working practices are robust (think ISO27002 etc) and that they are a low risk from a corruption perspective (credit, criminal and background checks.) you do carry out these checks on your own staff, right?

These questions become much easier when you explicitly exclude those with previous convictions, and justifying your decision to the board is also easier when you don't need to answer the "you gave a convicted hacker permission to break into our banking system?" type questions.

You also have two interesting assumptions I would challenge:

Costs

• despite contrary claims, large penetration testing companies can usually beat or at least equal the day rates. Sometimes this is by delivering from appropriate regions (eg I used to outsource remote testing to around 18 different countries to deliver follow-the-sun testing work from a wide range of skilled testers so as to allow them sensible working hours - thus avoiding overtime and the associated costs - and just carry out the QA locally) and sometimes by just having a sensible rate card.

Skills

• the classic view of a blackhat hacker is that they are incredibly skilled and clever and will always be better than a trained security consultant. Typically this is untrue on both sides. The best blackhats are often funded by organised crime and do develop new exploits all the time, so the whitehats are always playing catch-up, but whitehat training is on a par and experience provides something the standalone hacker never gets: experience across the whole gamut of exploits, vulnerabilities, business risks etc. For example:

Penetration testing is valuable, sure, but only as a tool to validate a security stance, or the implementation of specific controls. From a business perspective it doesn't even show on most corporate risk registers as anything other than an audit point. The reason for this is that it doesn't provide a big company with value other than a "yes - we have secured appropriately" or "no - we need to do more work", whereas the wider picture a CISO needs is all around minimising the potential for issues, eg by implementing an SDLC, layered technical and manual controls and so on.

• I think the key phrase here is to 'exclude those with prior convictions'. You don't need a criminal to break in, there are plenty of honest and accredited security professionals. – Julian Sep 15 '11 at 9:59
• I'm not sure if convictions are an appropriate measure of current trustworthiness. A good hacker might not get caught, an unethical one might change. However, a security company is expected to vet their personnel, and is liable anyways. – chris Sep 15 '11 at 17:56
• I believe that best hackers are really the ones who never got into the trouble. I do belive, though, that if person have a criminal record then he or she is doomed not only by public, but as any other person with serious criminal record would be doomed too. Criminal record also doesn't mean that hacker is the best of the best (since got caught). – HelpNeeder Sep 15 '11 at 18:18

Besides the points which are mentioned, there is another aspect which is in my opinion quite important.

Whitehats are often trained to translate hacker babble to understandable language for management. A manager or executive is not interested in the fact that there is an SQL injection, nor does he care that the latest patches are not applied. He wants to know how these would impact his business. Understanding business is key here. An SQL injection in one case can mean that he does not safeguard the privacy of his users and thus can be fined (business risk) while in another case it could be that an SQL injection may lead to unreliable figures for the company accountant or increased chance of fraud (business risk).

A trained whitehat can translate a vulnerability in a system to a business risk, while a blackhat can only talk technical 'gibberish' the manager doesn't care about nor understands.

Hence, although you may pay more for a hired security consultant, the results you get are in my opinion far better and hence make it a founded investment.

• This is a good point. Company cares about profits and only cares about security when it have some negative impact on his business. Since we're talking about Big Company, I wouldn't think that matter of money should be taken in a role, instead, company could meet higher standard in security. – HelpNeeder Sep 15 '11 at 22:24

This ethics question isn't very realistic. The actual facts make this an easier question than your instructor may have intended it to be:

• If you want a good evaluation of the security of your site, hiring someone to try to hack into it is not the best way to get one. Many people who are the new to the business think that the way to test security is to hire a red team to behave just like a bunch of hackers, try to hack in, and see if they succeed. However, that's a misconception. It's an understandable mistake, but it's still not accurate.

Instead, the best way to get a serious security evaluation is to hire a security professional and give them full access to information about your processes, practices, and code. The professional will be able to give you a much better evaluation, if he/she has access to that information. You might be tempted to say: a hacker wouldn't know that, so why should I tell it to the security evaluator? The answer is that it gives the evaluator leverage: a problem that a hacker might be able to find in 100 hours without the information, might be spotted by your evaluator in 10 hours with the information.

Here's an analogy. If you were thinking of buying a used car and took it to your mechanic for an evaluation, would you tie your mechanics' hands by saying "you're not allowed to open the hood, you're not allowed to look at the owner's service records, and you're not allowed to look at the warranty"? No, that'd be silly. You'd give the mechanics as much information and access as possible. The same should go for a security evaluation.

• Criminals are not better at evaluating security than honest professionals. On the contrary, for the most part, honest professionals will likely be able to do a much better job than criminals. Many criminals don't actually know very much about the technical side; they know just enough to make money, but certainly not more than a skilled honest professional.

Your problem statement seems to assume that convicted criminals will be more effective at helping you understand the security risks your business faces. However, this assumption is not accurate in practice.

Once you understand the real situation better, you will see that there is little reason to specially seek out criminal hackers, and many reasons to be cautious of hiring them. In particular, there doesn't seem to much of an ethical dilemma here; even setting aside the ethics of the situation, why would you want to hire a criminal hacker? In practice, you probably wouldn't.

• Excellent points! Lets not forget that many times "hackers" are self-taught and lack a broader view of security both in technical terms and in how it blends with enterprise goals – George Oct 5 '11 at 7:33

From a practical point of view the answer seems really easy:

The question defines your role as "IT guy in in big company".

"Big company" implies that it is subjected to compliance requirements. Therefore the upper management desires a security certificates. Something, which they can use in a legal trial, to proof that they are not guilty of neglect. "We hired this c3wl dude phr3ak crack3r" will not help them in case of a successful attack.

"Big company" further implies that the company does have the ability to invest some money in security, if they care about the topic. At least it is not the personal money of the IT guy. Last but not least the "nobody ever got fired for buying [large company name]" phenomenon applies to your fictive character.

From the ethical point of view: Well, this is your homework.

Having said that, there is one reason, to hire a high profile criminal: Publicity. After you got headlines such as "Incompetent [company] destroys future of highly gifted 12 year old kid by pressing criminal charges", hiring that guy might be a good approach.

• It is my homework. But I just needed to know more about pluses and minuses about this topic. As I stated my explanation, I had my mind fixed on this topic, but I needed to know if I was looking into right direction. Thank you for your answer. – HelpNeeder Sep 15 '11 at 18:13

## protected by Community♦Jan 10 '16 at 19:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).