Ethical Hacking Methodologies and Laws

Penetration-Testing Methodologies

• Black Box: Testers have no prior knowledge of the system.
• White Box: Testers have full access to system details and architecture.
• Gray Box: A combination of black and white box knowledge; partial information is provided.

Computer Fraud Abuse Act

• Federal law criminalizing unauthorized access to classified or financial information.

CAN-SPAM Act

• Legislation designed to combat unsolicited commercial emails (spam).

Electronic Communication Privacy Act

• Makes it illegal to intercept any form of communication, regardless of transmission method.

Certified Ethical Hacker (CEH)

• A certification from EC-Council focused on ethical hacking skills.

Certified Information Systems Security Professional (CISSP)

• Non-vendor-specific certification by (ISC)², validating expertise in information security.

Crackers

• Malicious hackers who infiltrate systems with the intent to damage or destroy data.

Ethical Hackers

• Individuals permitted to test systems for vulnerabilities, acting with the owner's consent.

Global Information Assurance Certification (GIAC)

• Certifies skills of security professionals, established by the SANS Institute in 1999.

Gray Box Model

• Penetration testing model that combines aspects of both black box and white box methodologies.

Hacker Definition

• Users attempting unauthorized access to computer systems or networks.

Institute for Security and Open Methodologies (ISECOM)

• A nonprofit organization supporting training and certification for security professionals.

Open Source Security Testing Methodology Manual (OSSTMM)

• Widely used security-testing manual created by Peter Herzog, outlining methodologies.

OSSTMM Professional Security Tester (OPST)

• Certification designated by ISECOM for penetration and security testers.

Packet Monkeys

• Pejorative term for unskilled hackers who use stolen code instead of creating their own.

Penetration Test

• Authorized simulated attacks on a network to identify vulnerabilities, performed by ethical hackers.

Red Team

• A collaborative group of penetration testers simulating attacks against a network.

Script Kiddies

• Inexperienced hackers who utilize scripts or programs developed by others to exploit systems.

Security Test

• A comprehensive examination of security policies and procedures beyond just breaching systems.

SysAdmin Audit Network Security (SANS) Institute

• Established in 1989, this organization offers worldwide training and various security certifications through GIAC.

White Box Model

• A testing approach allowing full communication with staff and complete details about the network’s architecture.

Hacker Definition by U.S. Department of Justice

• Characterized as individuals accessing computers or networks without authorization.

Role of a Penetration Tester

• Security professionals engaged to test networks for vulnerabilities through ethical hacking practices.

Terms for Inexperienced Hackers

• "Packet monkeys" and "script kiddies" are terms used for unskilled hackers relying on external scripts.

Penetration Testing Models

• Security testing performed using three primary methodologies: white box, black box, and gray box.