The connection between ethical hacking and penetration testing is fairly straightforward, as the former typically involves the use of the latter. Ethical hacking refers to actions of people employed by a company to attempt to hack into that company’s system or network, to demonstrate weaknesses or ways in which someone may launch a malicious attack against that company. Penetration testing is basically an attempt to penetrate a secure system in order to mimic the way someone may maliciously attack the system. This means that people are often hired by a company to engage in ethical hacking and penetration testing for that company.
Someone who is hired by a company to perform ethical hacking and penetration testing on that company’s system is often referred to as a “white hat” hacker. He or she employs the same methods and types of software used by a “black hat” hacker who might attack a system to gain information for malicious reasons. If a white hat hacker does gain access to a system, however, then he or she reports weaknesses and how he or she was able to succeed in the attack. A black hat hacker is likely to keep such information secret and use it for his or her own personal gain.
The association between ethical hacking and penetration testing is largely based on how both terms are used in the computer security industry. Ethical hacking is typically used by white hat hackers to describe the types of services they provide. Someone engaged in ethical hacking is, for all intents and purposes, attempting to gain access to a secure system or network using the same methods and software any malicious hacker might use. The major difference between this type of hacking and malicious hacking, however, is that an ethical hacker does not install malicious software in a compromised system or use the system for his or her own gain.
One of the ways in which ethical hacking is often achieved is through a process referred to as penetration testing. This is basically an attempt to penetrate the security of a system or network. Ethical hacking and penetration testing are engaged in to ensure that weaknesses are found through ongoing testing and to provide information on how those weaknesses can be eliminated.
“Black box” testing means that an ethical hacker does not have information about the system he or she is trying to access and is attempting to attack the system in the same way someone on the outside might try. This replicates an attack from someone who is targeting a company from the outside. In contrast to this, “white box” testing provides an ethical hacker with information about the system, to replicate an attack by a hacker with inside knowledge about a system, such as an attempt from a former employee.
