2KKUU7ita

Chapter 3: Developing Your Ethical Hacking Plan
✓ How will ethical hacking improve security, IT, and the general business?
✓ What information are you protecting? This could be personal health
information, intellectual property, confidential client information, or
employees’ private information.
✓ How much money, time, and effort are you and your organization
willing to spend on ethical hacking?
✓ What specific deliverables will there be? Deliverables can include anything
from high-level executive reports to detailed technical reports and
write-ups on what you tested, along with the outcomes of your tests.
You can deliver specific information that is gleaned during your testing,
such as passwords and other confidential information.
✓ What specific outcomes do you want? Desired outcomes include the
justification for hiring or outsourcing security personnel, increasing
your security budget, meeting compliance requirements, or enhancing
security systems.
After you know your goals, document the steps to get there. For example, if
one goal is to develop a competitive advantage to keep existing customers
and attract new ones, determine the answers to these questions:
✓ When will you start your ethical hacking?
✓ Will your ethical hacking be blind, in which you know nothing about the
systems you’re testing, or knowledge-based, in which you’re given specific
information about the systems you’re testing, such as IP addresses,
hostnames, and even usernames and passwords? I recommend the
latter.
✓ Will this testing be technical in nature, involve physical security assessments,
or even use social engineering?
✓ Will you be part of a larger ethical hacking team, sometimes called a
tiger team or red team?
✓ Will you notify the affected parties of what you’re doing and when you’re
doing it? If so, how?
Customer notification is a critical issue. Many customers appreciate that
you’re taking steps to protect their information. Approach the testing in
a positive way. Don’t say, “We’re breaking into our own systems to see
what information is vulnerable to hackers,” even if that’s what you’re
doing. Instead, say that you’re assessing the overall security of your
computer systems so the information will be as secure as possible.
✓ How will you know whether customers even care about what you’re doing?
✓ How will you notify customers that the organization is taking steps to
enhance the security of their information?
✓ What measurements can ensure that these efforts are paying off?
37