What Is Ethical Hacking? | University of Nevada, Reno (2023)

In the digital world, “hacking” is the practice of exploiting computer systems or private networks to gain unauthorized account or system access and steal, modify or destroy data. This malicious act can have a devastating impact on individuals and businesses.

According to market and consumer platform Statista, in the first half of 2022 alone, the United States had 817 data compromises that affected more than 53 million people. For U.S. companies that fall victim to hacking, the average cost of a data breach is $9.4 million, IBM reported in 2022.

Ethical hacking employs the same strategies and methods that unscrupulous hackers use, but its intent is to identify security vulnerabilities so that individuals and companies can defend against unauthorized access to systems and data. This tactic is among the focuses of cybersecurity education, and professionals with expertise in this area are in high demand.

Ethical Hacking: What Is It?

So what is ethical hacking? Like hacking that intends to do harm, ethical hacking involves accessing secure digital devices and networks. But those who take part in ethical hacking do so with the intent of finding vulnerabilities that an individual, company or government can correct to prevent cyber attacks.

Ethical hacking, sometimes called white hat hacking, seeks to proactively expose security problems. When an ethical hacker identifies vulnerabilities in a device, network or program, they fix those issues before malicious hackers can find them.

Although they rely on the same knowledge and skill set that criminal hackers use, ethical hackers abide by some key principles that help ensure their work is beneficial — not harmful. Ethical hacking calls for:

Gaining legal authorization to assess the security of a digital device or system
Coordinating the project scope to ensure it stays within permitted parameters
Notifying the device or system owner of any vulnerabilities uncovered
Protecting the security of data uncovered

What Ethical Hacking Protects

Ethical hacking can reveal security issues in a variety of tools and systems that individuals, businesses and government agencies use. Among the systems and devices most vulnerable to malicious hacking are:

Email, which hackers can use to spread malware — including ransomware, which locks down data and demands a ransom to restore access — and to embed malicious attachments or links
“Jailbroken” phones, whose operating systems hackers infiltrate, allowing them to install apps and steal data
Routers, which cybercriminals can hack to access data or cause large-scale disturbances like disrupting the flow of that data
Smart devices, including phones and other internet-connected tools and equipment, which hackers can use to steal or corrupt data
Webcams, which cybercriminals can hack to spy on users and infiltrate their computers to see their activity and messages

Issues That Ethical Hacking Uncovers

Ethical hacking is what many organizations rely on to uncover security problems. By attempting to gain unauthorized access to networks, systems, servers, devices, applications and programs, a white hat hacker can find vulnerabilities such as:

Broken authentication, which hackers can exploit to collect passwords and other account information to assume a user’s identity
Data exposure, which can reveal sensitive information
Injection attacks, which cybercriminals use to place code or malware in a system, allowing them to issue commands remotely to change data or text
Security misconfiguration, which occurs when security settings are not in use or have errors

History of Ethical Hacking

The practices associated with ethical hacking trace back to 1967, when IBM invited high school students to test its new computer. The students went beyond exploring the readily accessible parts of the computer system, learning its language and penetrating unauthorized areas. IBM responded by removing the vulnerabilities that the students had uncovered.

The term “hacking” emerged in the 1970s, with popular culture contributing to broader use of the term in the 1980s. Movies like “Tron” and “WarGames” focused on characters who hacked computer systems. The first commercial antivirus software was available by the end of the decade.

By the 21st century, widespread internet use offered a variety of opportunities for hackers to launch attacks. Today, many types of hackers work to gain access to digital devices and systems, some with the aim of doing harm and others with the goal of protecting users.

Value of Ethical Hacking

Ethical hacking is a key source of protection for people, organizations and government agencies that are potential targets of cybercriminals. The practice can provide benefits such as:

Identifying vulnerabilities through methods that mimic those of an attacker, informing strategies to best protect against breaches
Showing how cyberattacks might occur in devices’ and systems’ day-to-day use by performing real-world tests
Implementing security measures that protect against identified threats
Building customer and investor trust in companies, based on high levels of data and system security

Limitations of Ethical Hacking

Ethical hacking isn’t without its limitations, however. By adhering to the principles that ensure their hacking is ethical, white hat hackers face some constraints that their malicious counterparts might not. Those limitations can include:

Narrow scope, which may prevent them from moving beyond agreed-upon parameters regardless of the need to do so
Fewer resources, including limits to time, budget and computer power
Testing restrictions, which may prevent ethical hackers from employing test cases that could potentially cause servers to crash

What Is White Hat Hacking’s Role in Cybersecurity?

Cybersecurity is the practice of protecting computer systems from cyberattack. Ethical hacking, or white hat hacking, is a component of cybersecurity.

(Video) My Cybersecurity Degree in 7 Minutes (and 32 seconds)

The field of cybersecurity relies largely on noninvasive approaches to uncover security issues. Cybersecurity professionals like security architects often use techniques such as:

Audits — Evaluations of information technology (IT) systems, policies and operations and their use
Risk assessments — Reviews of threats to IT systems, data and networks and the potential damage those security issues could cause
Questionnaires — Collections of questions that gather information about potential digital security weaknesses among an organization’s vendors and service providers

But ethical hacking, which uses invasive tactics in an attempt to penetrate devices and systems that have restricted access, is also an important part of cybersecurity.

Noninvasive and invasive approaches to cybersecurity often work in tandem, with ethical hackers uncovering information about vulnerabilities that help to inform overall cybersecurity measures. White hat hackers can identify risks that noninvasive approaches to cybersecurity might not catch.

Cybersecurity professionals use information gleaned through both noninvasive and invasive approaches to ensure that protections are working correctly. Among the features and processes they use are:

White Hat Hacking vs. Black Hat Hacking

The name “white hat hacker” pays homage to heroes in early Western movies, who traditionally wore white hats. Villains in these movies often wore black hats, so a common term for criminal hackers is “black hat hacker.”

Black hat hackers carry out a range of cyberattacks, such as:

Cryptojacking — Using a computer to remove cryptocurrencies from an account and move them to the hacker’s virtual wallet
Data breaches — Accessing personal identifiable information (PII) like names, financial information and Social Security numbers
Identity theft — Obtaining an individual’s personal information and then using that data for fraudulent activity like making unauthorized purchases
Distributed denial-of-service (DDoS) attacks — Dumping excessive internet traffic on a server, network or service
Phishing — Using email, calls or texts to trick users into providing sensitive information
Ransomware — Blocking data access and demanding a ransom to restore it

Other Types of Hackers

White hats and black hats aren’t the only types of hackers. Other hackers also work to gain unauthorized access to devices, networks and programs. Of those groups, which are ethical hackers, and which are malicious? Following are descriptions of other common kinds of hackers:

Gray Hat Hackers

Gray hat hackers attempt to exploit vulnerabilities in digital systems and processes. If they gain unauthorized access, sometimes they commit minor cybercrimes, like taking small sums of money. Typically, however, they contact the user to offer to correct the problem for a fee.

Blue Hat Hackers

Hacking for revenge is sometimes called blue hat hacking. Its perpetrators typically aren’t sophisticated cybercriminals, instead simply targeting individuals or businesses they believe have wronged them.

Green Hat Hackers

Green hat hackers are new to hacking and are eager to learn more about its techniques. These hackers often attend hacking conferences to explore what it involves and how to improve.

Script Kiddies

Hackers who download malicious codes to use in computer viruses are called script kiddies. Often their goal is less about inflicting damage and more about impressing their friends.

Hacktivists

People who hack to advance a cause are called hacktivists. Once these hackers gain access to unauthorized devices and systems, they typically launch DDoS attacks to spread messages about an issue.

What Is an Ethical Hacker’s Job?

Professionals who perform ethical hacking are responsible for a variety of tasks that help ensure that people’s and organizations’ devices, networks and programs are protected against unauthorized access.

So, what is an ethical hacker’s job? Professionals in this role typically work for companies like:

Financial institutions
IT firms
Government agencies
Telecommunications companies
Law firms

Ethical hackers may serve as employees of these organizations, or they may be self-employed, performing work as independent contractors.

Ethical Hacker Job Responsibilities

Ethical hackers’ work typically centers on penetration testing, or pen testing. This term refers to the practice of probing a computer system to find vulnerabilities and other problems. When performing this type of testing, ethical hackers must ensure that they have authorization from the system owner and that they don’t damage the network.

(Video) Preceptor Orientation Video

The main responsibilities of ethical hackers include:

Assessing system security — Identifying security risks and recommending approaches for addressing them
Determining threat levels — Noting the potential for negative outcomes associated with identified vulnerabilities
Reporting test findings — Compiling information about the results of testing to share with system owners

Ethical hackers often correct the issues their work uncovers themselves, although other cybersecurity professionals may be tasked with making those adjustments.

For ethical hackers who work independently, their work may include competing for bug bounties. Some companies offer these financial rewards for finding flaws in their systems and applications before malicious hackers discover them.

Ethical Hacker Salary and Job Outlook

Because their work is so valuable to organizations, ethical hacking provides the potential for a salary that’s well above the average for all careers, and its job outlook is strong.

Ethical Hacker Salary

The median annual salary for ethical hackers was about $84,800 in February 2023, according to compensation data provider Payscale. Experienced ethical hackers with 10 to 19 years of experience or more earned a median annual salary of about $111,900.

Furthermore, the U.S. Bureau of Labor Statistics (BLS) reported that the median annual wage for information security analysts, a role similar to ethical hackers, was $102,600 in 2021.

Ethical Hacker Job Outlook

Ethical hackers are in high demand. The BLS projects 15% growth for all computer and IT occupations between 2021 and 2031, three times faster than the 5% average growth projection for all occupations.

For information security analysts, the projected demand is even greater: The BLS projects 35% growth for that role, adding more than 56,000 new jobs between 2021 and 2031.

The BLS cites the following reasons for this projected growth:

Growing number of cyberattacks in recent years
Rising number of remote workers who use off-site — and sometimes unprotected — computer systems and devices
More reliance on web-based shopping that can place users’ financial information at risk
Increasing use of digital health services that can leave patients’ health data and other personal information vulnerable

How to Become an Ethical Hacker

The steps to pursuing a career in ethical hacking include cybersecurity-focused education and training, with many ethical hackers also earning certifications.

Ethical Hacker Education and Training

Typically, the first step on the path to becoming an ethical hacker is earning an undergraduate degree in a discipline like computer science, math, engineering or cybersecurity. Ethical hackers often hold graduate degrees in similar subjects as well. Their education should teach them about topics such as:

IT troubleshooting
Hacking
Software programming

Ethical hacking roles usually include extensive on-the-job training in hacking, software development and security. Some employers require that employees complete this training before taking on full-time roles with their organization.

Ethical Hacker Certifications

Earning professional certifications can help ethical hacking professionals establish their credibility and gain an advantage in their job search. After earning initial credentials and gaining experience, these professionals often pursue more advanced certifications.

Early-Career Certifications

A variety of initial certifications are available that relate to information technology and cybersecurity, and earning degrees in these fields can help prepare ethical hackers for these credentials. The certifications generally require applicants to take a course — with some permitting on-the-job experience instead — and pass one or more exams. Certifications include:

Computing Technology Industry Association (CompTIA) A+
CompTIA Security+
CompTIA Network+
Cisco Certified Network Associate (CCNA)
GIAC (previously known as Global Information Assurance Certification) Security Essentials (GSEC)
GIAC Certified Forensic Examiner (GCFE)
GIAC Certified Intrusion Analyst (GCIA)
GIAC Security Essentials (GSEC)
International Information System Security Certification Consortium, or (ISC)2, Certified Information Systems Security Professional (CISSP)
(ISC)2 Systems Security Certified Practitioner (SSCP)
(ISC)2 Systems Security Certified Practitioner (SSCP)

Advanced Certifications

Certifications specifically for the ethical hacking field are available to more experienced IT professionals. The most common credentials include:

Certified Ethical Hacker (CEH), from the EC-Council. To earn this certification, which is helpful for pursuing IT roles in government and the private sector, applicants may take a preparatory course or gain on-the-job experience.
Offensive Security (OffSec) Certified Professional (OSCP), which is also beneficial for professionals looking to advance in their ethical hacking career. Those pursuing this certification must take a course and a timed network penetration test.

Ethical Hacker Skills

Becoming an ethical hacker typically requires some key skills and aptitudes, including the willingness and ability to stay up to date on the latest hacking tricks and techniques. Among the competencies that are beneficial for this career are:

Problem-solving — To find new ways to address potential attacks now and as new threats emerge
Knowledge of social engineering — To educate about and protect against these threats, which cybercriminals employ to trick users into providing access to their data
Programming — To develop code that mimics threats and design protections against them
Research — To uncover new tactics that malicious hackers are using and approaches for guarding against them
Communication — To explain system vulnerabilities and recommended fixes to those who lack cybersecurity expertise and may be unfamiliar with the technology
Collaboration — To work with other cybersecurity professionals as well as the users of devices, networks and programs to uncover and correct problems
Database management — To ensure that the databases they create and maintain remain protected from unauthorized access

Protect Individuals and Companies Through Ethical Hacking

Ethical hacking is what individuals and organizations turn to for help protecting their digital tools and systems. If you’re ready to pursue this in-demand cybersecurity career, explore the online Master of Science in Cybersecurity program at the University of Nevada, Reno.

(Video) UCED Podcast: Cyber Security UNR

The 100% online curriculum offers opportunities to gain technical and leadership skills and knowledge, regardless of whether your bachelor’s degree is in a related field like engineering, math or science. And the program’s flexibility allows you to stay in your current professional role while also pursuing your master’s degree.

Discover how the online Master of Science in Cybersecurity program at the University of Nevada, Reno, can help you reach your professional goals.