As organisations adopt work-from-home operations or transition to a more remote setup due to the global COVID-19 crisis, cybersecurity has become a significant priority to safeguard sensitive data and communications from cyber threats.
There are many terminologies used in the world of cybersecurity and information security, especially since the field is constantly evolving to match current developments and trends.
Since the inception of the concept and science of ethical hacking in 2003, EC-Council’s CEH (Certified Ethical Hacking) certification has been popularised and mistakenly perceived as a penetration testing course. However, ethical hacking is vastly different from penetration testing.
What is ethical hacking?
Ethical hacking is a practice that allows certified ethical hackers to continuously assess an organisation’s security posture by employing the same tools, methods, techniques, and tactics used by a cybercriminal or malicious hacker.
With deep knowledge and understanding of an organisation and its vulnerabilities, they can identify risks and set up countermeasures to safeguard its data and communication assets.
What is penetration testing?
Penetration testing is a coordinated assessment process performed by a team based on the scope provided by the organisation. In other words, the organisation defines what is to be tested and reported, and a group of pen-testers would assess the organisation’s system using a predefined methodological approach to identify risks and vulnerabilities.
From there, a comprehensive pen-test report is generated with an executive summary along with key findings and recommended strategies for the organisation to take action.
Penetration testing is usually employed for compliance reasons such as security audits.
Critical differences between ethical hacking and penetration testing
1. Visibility of organisation’s infrastructure
Ethical hackers must possess a comprehensive knowledge of the organisation’s infrastructure and processes to carry out their assessment to mimic a cybercriminal’s actions to expose critical vulnerabilities and security lapses that can potentially be exploited.
On the other hand, Pen-testers are generally provided with limited to no information of the organisation’s infrastructure to carry out their assessment. As the organisation is responsible for defining the scope of the testing and report, pen-testers do not need information about their infrastructure. They would carry out the assessment based on what was predefined for them.
2. Engagement
Ethical hackers are continuously engaged and employed to assess the organisation’s systems and ensure defence-in-depth. Defence-in-depth is an information assurance strategy that puts in place several defensive measures in case of failed security controls or vulnerabilities that arise.
In contrast, pen-testers are only employed for a one-time engagement for a limited duration for the organisation’s security audit.
3. Scope of knowledge
Ethical hackers need to be equipped with detailed knowledge of tactics, techniques and procedures (TTP) and various penetration testing tools to mimic the actions of a cybercriminal.
Meanwhile, a pen-tester needs to have sound knowledge of the dedicated domain or specific area they are conducting their testing on.
4. Incident handling
In the event of an incident, the involvement of ethical hackers and pen-testers in the incident handling and response process is vastly different.
Ethical hackers are required to assist incident handling teams and blue teams in incident containment and validation, whereas pen-testers have no security configuration and incident handling responsibilities.
5. Report writing
While there are no mandatory requirements for ethical hackers to know about report writing, pen-testers have to generate a foolproof report at the end of their penetration testing.
Conclusion
As you can see, ethical hacking differs significantly from penetration testing. Ethical hacking has a part in the penetration testing process, but ethical hacking is not penetration testing. The job scopes of ethical hackers and pen-testers are similar in that they enhance an organisation’s cybersecurity protocols. Still, each of their expertise lies in different areas.
If you are looking to build pen-testing capability for your organisation or trying to develop the cybersecurity capabilities of your IT team in-house instead of relying on a third-party firm, look no further.
At Bridging Minds, we provide a large variety of IT security courses in Singapore, such as EC-Council’s Certified Penetration Testing Professional (CPENT) course, to develop the cybersecurity capabilities of your employees and IT personnel so that they can protect the organisation and its assets. We also have other courses that provide funded project management training, and more. Our 2022 classes are open for registration, so hurry up and sign up before the slots are filled up!
