- [Instructor] So what is ethical hacking
and penetration testing?
If you're watching this video course,
you most likely already have some understanding
of what is pen testing.
So I'm not gonna cover all the basics here.
However, I do want to cover
and discuss a few of the differences
between an ethical hacker, a malicious hacker
and also a few key concepts like red teaming
or red teams and offensive security as a whole.
An ethical hacker is a security professional
that will try to mimic a malicious hacker.
The main difference is that he or she those that,
you know attempt of compromising a system
or mimic a malicious attacker with permission.
That is the main difference, the word permission.
Also the scope in penetration testing determines
what a pen tester can do and cannot do.
We will definitely go over scope
and a lot of different things that you have to do
in the pre-engagement activities later in the course.
Now you also have probably heard the concept
of red teaming, right? Or red teams.
Basically a red team is like a team
of ethical hackers like you and me
that try to mimic a true attacker.
They tend to operate with a little bit more freedom
and bigger scope than a traditional pen tester.
However, one thing that I want to highlight is that
the effectiveness of a true red team completely depends
on the maturity level of the company
and the culture of the company as a whole.
Now, most people in the computer technology field
will consider themselves as hackers, right?
By the simple fact that you actually are somebody
that is thinking out of the box that is actually trying
to figure out things out of the normal
and of course, in the offensive security aspects of things
that you are actually trying to break into systems.
This obviously is not a malicious thing, right?
Of course, remember the word permission.
So if you have the permission and you're hired to do that
that's why, you know, good key scope, you know
the clear scope and also a specific rules of engagement
is crucial for any pen testing activity.
So the key factor here is actually defining ethical
versus non-ethical hacker, right?
So of course an unethical hacker does all that
for a malicious intent,
whether it's to steal corporate secrets,
to or intellectual property, to steal money, right?
Either credit card information or true money.
For in the case of activism,
to protest against some political activity
or they don't believe in a specific,
you know political movement
or even the company culture of a specific company
or they're trying to protest against something, right?
So there's many different levels of,
or types of non-ethical hackers
or malicious hackers out there.
Now, a security researcher looking
for vulnerabilities in products, applications
and web services is actually considered an ethical hacker.
Now their responsibilities actually, of course
to disclose those vulnerabilities to the person that
or the company that hire them, or in the case
that they're actually doing vulnerability researching
in their own, they must disclose responsibly
those vulnerabilities to the vendors or owners
of that target research.
So why do we need pen testing though?
First of all, as somebody that is responsible
for securing defending a network or system
you actually want to find as many potential vulnerabilities
before the bad guys, you know, do this.
You know, for years we actually have developed
and implemented many different defensive techniques
like antiviruses, firewalls, nutrition prevention system,
anti-malware.
However, we have to find ways to make sure
that those are effective, right?
And that we also continuously look for ways
on how bad guys can compromise our systems,
and of course do malfeasance.
Now in many different scenarios, penetration testing
is a mandatory requirement
by many different regulations out there, right?
Things like PCI or HIPAA, you know, they mention
that you must have a penetration testing assessment
at least once a year.
That's a typical guidance, you know, out there.
And we actually gonna be covering a few things especially
around compliance based pen testing later in the course.
As you know, systems as networks change constantly.
And as a matter of fact, you know, technology
is changing constantly at a very rapid pace
and it's not gonna slow down,
it's actually gonna be worse, right?
So that means that
the tech surface can also change as well, right?
You have to consider this whenever you
are beginning a penetration testing career.
And even if you are in a intermediate or advanced phase
you have to, you know, all the time, reinvent yourself
and try to actually keep up with new technologies
and new trends because that's, you know, how you become
a better pen testing.
It's not so much about tools is more about the methodologies
is a lot about the techniques.
And then you also having, you know, a way to adapt
to learn new technologies and to find ways on how to attack
and compromise those technologies and those systems.
So I'm gonna be highlighting this throughout the course
and then in the next sections,
you're actually gonna be looking
into how the current landscape is actually changing related
to security and also exploring
the different penetration testing methodologies.
Again, it's not much about tools,
it's a lot about methodologies, how to build your own lab
and tips on how to prepare specifically for this exam.