3. HEAPS OF HORROR STORIES

Whether you work with a large specialist organisation, an MSSP or a solo expert, your ethical hacker should be exceptionally experienced and passionate to boot. So, when you ask about their background, similar projects and white-hat approach, expect to be met by a wealth of insight and (anonymised!) tales from their ethical hacking history.  

When green-lighting an ethical hacker, your business essentially surrenders its IT infrastructure to a third party. As a result, there is zero room for compromise in knowledge, skills and experience. Therefore, when shortlisting your ethical hackers, pay special attention to their authenticity and enthusiasm when recalling past projects – it may well set apart the smart but under-practised from a trusted white-hat veteran.   

4. CERTIFICATIONS THEY CAN EXPLAIN

When hiring an ethical hacker to test your organisation’s security posture, look for tester certifications indicative of the highest skill levels, such as CREST. It’s also a good sign when consultancies or MSSPs hold information security and quality management certifications, including ISO9001, ISO 27001 and ISO22301. After all, ethical hacking demands you put your faith in secretive skills and you may appreciate knowing that your white-hat hacker is accountable beyond the four walls of their operation.  

Most importantly, ask your potential ethical hacker how they apply the knowledge acquired through certification. Achieving a certification is one thing – living its principles after the fact determines the quality of service you receive.  

5. BULLETPROOF BRIEFING 

If you hire an ethical hacker, expect to add “limit of exploitation” to your cybersecurity vocabulary. This describes how deep you’ll permit ethical hackers into your IT systems and what they’re allowed to do.  

With IT and data being the backbone of business operations, it makes sense that you create a bulletproof, crystal-clear brief, ideally in collaboration with Compliance teams. Where live testing threatens availability, consider developing a replicated environment for ethical hacking.  

6. SURPRISING PROPOSITIONS

Don’t be surprised if an ethical hacker suggests that you stretch the limits of your comfort zone. Some white-hat hackers like to thoroughly test the rigour of your digital perimeter by incorporating nefarious social engineering tactics. For example, they may target selected employees with personalised phishing emails, or take their deception further by physically infiltrating your premises with forged passes or planted USBs.  

An ethical hacker will never enter the physical realm unless your briefing scope allows it. So, although it may seem alarming initially, consider any social engineering proposition an ethical hacker puts to you. Doing so may unmask your most significant security vulnerability.  

7. NEW THINKING

One of the major costs in engaging and ethical hacker is the time taken to understand your architecture and configure testing equipment, with the act of running a scan then largely down to supervising a machine process.  

Finally, there is human effort in digesting and translating the evidence into a report. An emergent trend in the industry which a few companies have adopted (including Derivee Hackers ) is to let this test continue to run throughout the remainder of the year, rather than a dedicated testing window. In this way, your testing maintains its “currency” by constantly scanning your network. Clearly, invasive tests are not ideal when running unsupervised, but this new proposition is addressing the challenge of expensive resources who programme complex machines to give you better value throughout the year. 

The phrase “play them at their own game” has never been more accurate than in the context of ethical hacking.

With the cyberthreat landscape expanding and maturing, organisations cannot afford to let hackers gain the upper hand. The bottom line? To outpace cybercriminals, you need a defence capable of thinking and acting like the threat you face.  

To find out how Node4 can help look after your data, infrastructure and people, learn more about our security solutions here and contact us here