Ethical Hacking: Finding Vulnerabilities
This year, CardSystems Solutions, a third-party processor of payment card transactions, noticed that a hacker had gained unauthorized access to its database and installed a script to screen for particular transactions—placing more than 40 million credit card accounts at risk. Of the accounts involved, 13.9 million were MasterCard-branded cards, which include Maestro and Cirrus, and 22 million were Visa cards. The FBI was notified, and investigations began. This is not satisfactory.
Imagine a corporate network operating seamlessly across geographical regions with multiple software, improving productivity without ever throwing a glitch, with users shielded from malicious virus and forgotten passwords easily restored. Can you imagine your regular systems administrator ensuring this?
Some corporations tend to equate the strength of their corporate networks with their huge budgets. What they fail to understand is that even if they invest in the best technology, security is only as good as the weakest link—including the human link. The human link can be an ill-informed administrator, a disgruntled employee or an inept security professional.
Corporations also need to realize that no matter how good their production systems are in terms of functionality, they can be compromised easily if a vulnerability remains unpatched. How can these organizations empower their network administrators to man their information highways efficiently?
Consider the average administrator today. He spends more time managing a slow Internet connection, damaged mouse or even a not-so-clear monitor screen. This should not be the case with a proactive administrator who continually monitors the network, analyzes log files and screens for intrusions—both external and internal.
Few understand the complexities of the hacking world or that the most “recent” hacking tools available for download on the Internet can be used to compromise the network with just a mouse click. One of the most damaging reasons we are in this state is because systems administrators often are trained in a vendor-specific environment by the same company that manufactures the equipment or the operating systems in use. Vulnerability disclosures today seldom come from vendors. Most often, they are discovered by users, and the vendor is subsequently notified. The world hears about it when the vendor issues a hot-fix or a patch. Consider the number of fixes issued by Microsoft, one of the world’s leading operating system providers. When these vulnerabilities are discovered by malicious hackers, they are traded as “zero-day” exploits and subsequently exploited by malicious code, such as a virus.
The vendor-focused program is important to a certain degree, as it trains candidates on the inner workings of the system. Nevertheless, this leads to a feeling of complacency, with trained professional believing that the vendor-based program alone can make them proficient in securing the systems. They are oblivious to the fact that hackers are adept at compromising any vulnerable system.
This myopia costs corporations billions of dollars through various security compromises. Whether it is a simple denial of service or a more complex “man in the middle” attack, hackers cause damage that puts the corporations’ reputation and survival at stake.
Systems administrators come in various flavors: general system administrators, network administrators, application administrators, database administrators, security administrators and so on. What makes a system administrator stand out in the crowd?
The International Council of E-Commerce Consultants (EC-Council) offers a certification course in ethical hacking. Certified Ethical Hacker (CEH) training gives IT systems professionals a mastery of hacking tools and security systems as well as knowledge of how to hack via Windows and Linux. Students learn strong security system techniques, including how to deploy countermeasures that will prevent or contain hacker attacks. Information security professionals who carry the CEH certification are qualified to administer non-destructive penetration testing to e-commerce, e-business, IT security and other types of computer networks or systems.
The Certified Ethical Hacker certification arms systems administrators with critical information to identify, counter and defend the corporate network against harmful agents. It takes administrators into the minds of attackers and enables them to assess the security posture of the network from an attacker’s perspective. This differentiated perspective allows agile system administrators to deploy proactive countermeasures and stay at the bleeding edge of information security developments. A Microsoft Certified Systems Engineer (MCSE) equipped with CEH leads his organization’s information security resources in a sharp, focused and adaptable manner. He deals with security initiatives productively, rather than restricting the efficiency of the organization. Functionality is enhanced—not lost in the process of securing the organization.
Microsoft’s heightened visibility makes it especially vulnerable as a hacker target. Most critics are ready to shoot down the vendor of the operating system the minute it gets hacked. What they fail to understand is that the hack is not always due to a vulnerability of the operating system. Quite often, the admin has misconfigured the system and bears the ultimate responsibility. If an MCSE is armed with the knowledge of a hacker, he can significantly reduce the number of security breaches.
An MCSE with CEH stands out from the crowd because he is armed with the critical knowledge that makes him an extraordinary systems administrator. He is sought after by organizations as he brings more value to the table. He improves the organization’s return on security investment and reduces external security assessment costs. He is more than the guy who makes sure that cables connect or printers work—he is the vigilant systems administrator, constantly reassessing and defending the organization’s network and allowing other employees to improve efficiency in a productive workspace.
Sanjay Bavisi is vice president of the International Council of Electronic Consultants (EC-Council). Sangeetha Thomas is a research analyst for EC-Council. They can be reached at firstname.lastname@example.org.