Network Administrators Love Ethical  Hackers

What exactly is an Ethical Hacker, and more importantly, why do we need them?We contacted Inti De Ceukelaire in his hometown of Oilsjt, Belgium to ask him precisely that.

1 - Hi Inti. What’s an ethical hacker? And, do you consider yourself to be one?

Hackers are people that come up with creative and unintended ways to compromise a system’s security. So-called “Ethical Hackers”, like me, do exactly the same. The main difference is that we try to help affected companies instead of hurting them. Quite simply, we let the affected companies know about their particular vulnerability so they can fix it.

2 - What’s the #1 tool or solution that a Network Administrator should be using today to reduce hacking?

A responsible disclosure program or a bug bounty program. Ironically, this will actually increase hacking (but luckily only the good parts of it). The idea is that Ethical Hackers will then be encouraged to test your security features and notify you of any issues they encounter.

3 - What are the 3 things Network Admins should be doing today to mitigate against a hack?

If there was a three-step method to mitigate against any hack, my profession would probably not exist. But if I would have to give my top 3 tips to prevent Network Admins from being hacked, they would be:

A-Patch your systems. Most attacks are caused by publicly known vulnerabilities that have existed for months or even years. Make sure to update all systems on the network at least once a week.

B-Increase security awareness within the company you work for. Even if your system security is foolproof, your co-workers are not. In most cases, companies get hacked because of human mistakes.

C-Assume the hacker is already inside. The insider threat is often overlooked: try to maintain strict security practices within the company. Employees should only have access to tools and resources they need.

4 - How vulnerable are most individuals, companies or national networks against cyber-attacks?

Everyone is vulnerable to cyber-attacks. When measuring the level of security, the question that should be asked is not whether hackers would ever be able to get in, the real question is how easy it is to get in and how long it would take them.

Any company can be vulnerable to a data breach. In my opinion, we should only blame companies that haven’t taken sufficient responsibility and measures to prevent it from happening in the first place.

Inti De Ceukelaire: Staring down bugs.

5 - What keeps you up at night?

Excitement. Whenever I’m working on a "target" I tend to forget about the time and just keep going all night. The adrenaline rush that comes with it doesn’t make falling asleep easy!

But generally speaking, I try not to worry too much about things that are out of my control, especially when it comes to cybersecurity. I try to do my part by making the internet a safer place, one bug at a time, which is very satisfying.

6 - Are you ever tempted by the dark side?

I started hacking when I was a teenager and a lot has changed since then. Back in those days, security wasn’t that big of a deal and it was fairly easy to compromise a website and mess around once inside. I never actually caused any damage or committed any harmful actions, but given the fact that ethical hacking was mostly unheard of back then, what I was doing was considered as illegal as any other type of hacking.

Fortunately, things have changed. I was lucky enough to learn about the ethical hacking community at a very young age and haven’t considered doing anything not 100% white hat ever since. As you can guess from the term, ethics are very important in our community. We encourage all sorts of hackers to join our team- but once they’ve joined, there’s no way back.

Even though I have never considered engaging in any criminal activities, it does not mean that it’s always easy being an ethical hacker. As a hacker, you sometimes possess an incredible amount of power. There are also malicious actors out there that offer thousands of dollars for finding vulnerabilities in popular software. Given the fact that most ethical hackers start from a very young age, they aren’t always able to deal with the power that comes with it.

7 - Thoughts on the future and whether AI, biometrics, and decentralized data will help reduce hacking efforts? Or will it make it worse?

Everything that is connected to an external network could be prone to hacking. The internet of things, self-driving cars and biometrics provide a far wider surface for hackers to attack. At the same time, the security industry has made quite a lot of progress over the past few years. Web applications are generally a lot safer than they were ten years ago. While things evolve, the battle between good and evil will go on forever.

8 - What's your top advice for small businesses as an ethical hacker?

Hire me. No, seriously: get your assets tested by ethical hackers. External security researchers can offer fresh insights on your company’s state of security. Bug bounty platforms like Intigriti (intigriti.be) and HackerOne (hackerone.com) are very accessible for small businesses and start-ups and will increase your security by a fair amount.

9 - What is the most common mistake or flaw in systems you discover as an ethical hacker?

Most of the times it comes down to input validation. Programmers that create systems expect a user to behave in a certain way. Hackers can abuse this form of trust to enter malicious code instead of one of the expected values. 

10 - Social engineering vs technical hacks, what's more
prevalent nowadays?

Both happen all the time. Social engineering probably happens more because it’s often the easiest way to get into a company and requires no technical knowledge. That does not mean technical hacks are way less prevalent: they’re just more subtle and go unnoticed most of the time.

Thanks, Inti.