Finding Weaknesses and Improving System Security

Ethical Hacking

Ethical hacking means deliberately attempting to break into a system — but with the organisation's full knowledge and permission. The goal is to find vulnerabilities before a criminal does.

There are two types to know:

• White hat hackers are fully authorised security professionals hired by an organisation to test its systems. Everything they do is legal, documented, and agreed in advance.
• Grey hat hackers sit in the middle ground — they may probe systems without prior permission, and they don't intend to cause harm or steal data. However, their actions are legally ambiguous since they act without authorisation, and they may disclose what they find publicly or seek recognition rather than reporting directly to the organisation.

Advantages

• Finds real vulnerabilities that automated tools might miss, because a human thinks creatively like an actual attacker
• White hat testing gives the organisation a detailed report with actionable fixes
• Helps organisations meet legal and insurance requirements around security
• Provides reassurance to stakeholders that security has been independently tested

Disadvantages

• Expensive — skilled ethical hackers command high fees
• Requires significant trust; the hacker gains deep access to sensitive systems
• Grey hat hackers operate without permission, creating legal uncertainty for both parties
• Results reflect the system at one point in time — new vulnerabilities can appear after testing ends