Ethical Hacking vs. Penetration Testing vs. Auditing

Question 1

What is the difference?

Answer 1

MOTIVATION “RULES OF ENGAGEMENT”

Question 2

Penetration Testing aka Pentesting aka Red Team

Answer 2

Clearly define rules of what is and isn’t allowed

Question 3

Ethical Hacking

Answer 3

No rules, ethical disclosure

Question 4

Rules of ethical disclosure

Answer 4

1. Build Trust - Ethical hacking for the “right reasons”?
2. Inform the affected party first - Every effort is made to contact the vendor, giving ample time to fix before public disclosure
3. Coordinate efforts - including necessary affected stakeholders
4. Maintaining confidentiality where appropriate - observing internal policies, local regulations, and industry best practices

Question 5

Auditing

Answer 5

Detail network structure, detect vulnerabilities, assess risk management, prioritize risk

Compliance check, improvements, credibility, prevention fraud, budget