Ethical Hacking

Ethical hacking means using hacking techniques after the owner of the computer system or data has given approval. Hacking is often associated with illegal activity, but it is not always illegal. The key difference is permission: the owner must authorise the work.

Black hat and white hat

Black hat hacking means accessing a computer system or its data without consent from whoever owns it. The hacker has no permission, so the activity is illegal.

White hat hacking uses similar techniques to black hat hacking, but it has the owner's permission. White hat hackers are not criminals: they use their skills to help an organisation find weaknesses before a criminal does.

For example, imagine a school's online quiz stores the correct answers inside the web page. If a student digs out those answers to beat the quiz without permission, that is black hat hacking. If the school pays a security tester to try the same trick and report the flaw, that is white hat hacking.

Reporting what they find

If ethical hackers find security holes, they inform the organisation and help to fix the problem. They do not keep the weakness secret or exploit it for personal gain. For example, a tester might discover that an online shop shows another customer's order when the order number in the address is changed. They report it to the shop, and the developers add a check so only the correct customer can see the order. Fixing the weakness before an attacker finds it protects the organisation's data and systems.

Penetration testing and ethical hacking are both authorised ways of identifying network vulnerabilities. Both rely on the owner's permission and both aim to find weaknesses so that they can be repaired.