Ethical hacking is when an organization allows a known person or organization to attempt to break into or attack your system. This type of service usually takes the form of a penetration test or pen test. More on pen testing in a minute.
Hacking comes in three flavors: white hat, gray hat, and black hat. These are the “actors” or people that do the hacking.
Black hat hackers are the individuals (or countries) that capture the headlines. These individuals attempt to gain access to networks and computers without permission. Usually, they intend to either do harm, such as cause outages or DDoS (Distributed Denial of Service) attacks, or steal data to sell it for financial gain (such as payment card or healthcare information) or to steal information for their own use (such as when intellectual property or military intelligience is stolen).
According to Westley McDuffie, Security Evangelist for IBM and member of the IBM X-Force team, the term “black hat” came from the old Western movies where the villains wore … black cowboy hats.
White hat hackers also attempt to gain access to networks and computers, but their purpose is finding vulnerabilities before they can be exploited by a black hat hacker. And once again, the Western movie analogy holds because it was the “good guys” in the story that wore white hats!
Gray hat hackers straddle the line. Sometimes they act as a white hat hacker, but they are not always pure of heart. While they lack the malicious intent of a black hat hacker, they may break laws or act unethically.
What’s the Purpose of Pen Testing?
Ethical hacking is performed by white hat hackers. Organizations perform ethical hacking or penetration testing to discover weaknesses or vulnerabilities in their security configuration. The most well-known penetration tests occur at the network. Vulnerability scanners identify open ports, services with known weaknesses, etc., and run against all servers in the network—including IBM i.
More recently, penetration testing has been performed against the databases residing on the servers—again, this includes IBM i pen testing. One reason for this new focus is that while understanding weaknesses associated with the network is important, it’s only one aspect of security configuration that needs to be tested. Testing to determine if one can gain access to key database files is a very different type of testing than the vulnerability scans performed against the network.
How Is Pen Testing Performed?
Most pen testing against a database uses a method of testing called white box or gray box. White box testing is where the tester (typically a white hat hacker) has access to architecture and implementation documents. In other words, they have knowledge of or are given documentation to show how the server and database are configured. Using this information, the tester attempts to gain access to data using as many access methods as possible—FTP, ODBC, 5250 sign on, etc. Testing is often performed as a regular user rather than a super user to find the vulnerabilities that lurk in configurations and that can be exploited by a typical user.
Black box testing (not to be confused with a black hat hacker—someone with evil intent) is where the tester has no formal documentation of the systems’ or databases’ configuration and attempts access by exploiting well-known vulnerabilities or newly documented zero-day defects by performing random access attempts. (A zero-day defect is a new vulnerability not previously known or documented and for which there may be no fix or the fix has just been released.) While black box tests uncover weakness to these well-known vulnerabilities, they are rarely effective in uncovering the vulnerabilities that are unique to the organization’s specific database configuration and often require a great deal of trial and error to show whether the organization has vulnerabilities.
Gray box testing uses both techniques. The tester has access to configuration documentation, but also uses some random testing techniques or attempts to exploit a well-known vulnerability.
In no case is the intent of white box or gray box penetration testing evil or unethical nor is the intent one of destruction. Remember, white box and gray box testing are performed by a white hat hacker—or a good guy (or gal!).
Who Needs Pen Testing?
The point of penetration testing is to help an organization discover vulnerabilities, so they can be remediated before they are exploited by someone with evil intent—a black hat hacker. For this reason, numerous laws and regulations are now requiring penetration tests, not just at the network level but also against the database. The Payment Card Industry’s Data Security Standard (PCI DSS), the New York State Cybersecurity Law, and the 2018 Singapore Cybersecurity Act, to name a few, all require database penetration testing.
The Professional Security Services team at Fortra performs penetration testing for IBM i and has done so for several years. It’s an effective means of showing our clients how the vulnerabilities documented in our Risk Assessment can actually be exploited. And it’s been rare that we haven’t been able to gain access to IBM i and to data in ways that were not expected. These clients now have the opportunity to resolve those issues prior to them being exploited.
If you'd like to learn more about how pen testing can uncover vulnerabilities before an attacker finds them, Fortra can assist.
Find out how the security pros at Fortra can help you validate system vulnerabilities.