2KKUU7ita

Chapter 20: Ten Reasons Hacking Is the Only Effective Way to Test
Ethical Hacking Improves Understanding
of Business Threats
You can say passwords are weak or patches are missing, but actually
exploiting such flaws and showing the outcome are quite different matters.
There’s no better way to prove there’s a problem and motivate management
to do something about it than by showing the outcomes of ethical hacking.
If a Breach Occurs, You Have
Something to Fall Back On
In the event a malicious insider or external attacker still breaches your
security, your business is sued, or your business falls out of compliance with
laws or regulations, the management team can at least demonstrate that it
was performing due diligence to uncover security risks on a periodic and
consistent basis. A related area that can be problematic is knowing about a
problem and not fixing it. The last thing you need is a lawyer and his expert
witness pointing out how your business was lax in the area of information
security testing or follow-through.
Ethical Hacking Brings Out
the Worst in Your Systems
Someone walking around with a checklist can find security “best practices”
you’re missing, but he isn’t going to find most of the in-depth security flaws
that ethical hacking is going to uncover. You know, the ones that can get you
into the worst trouble. Ethical hacking brings out the warts and all.
349