Devices - Penetration Testing Like a Hacker. - SecNiche Security Labs

(NEW) STANDARDSNew PenetrationTesting Business ModelCrowd-sourcing For IT-SecurityToday everybody can become a hacker. The knowledge spreads allover the Internet. A lot of hackers are showing their know-how bysharing the results of their attacks. Why do not use this knowledgethrough crowd-sourcing in order to globally improve the security?Starting from this fundamental idea, a business model has beendeveloped by Hatforce.Almost daily we can see on the news that a newIT system has been attacked by hackers. Even ifit is about Sony [1] or the CIA website [2], theseattacks, harmful in 90% of the cases, show that behindthere lies a competent community who has a highIT security potential. We ask ourselves then: Wheredo these hackers come from? Are they employedprofessionals? Do they act with a well-defined purpose,or are they just smart individuals who don’t know whatelse to do with their knowledge and free time?The beliefs of a hacker may be not easy to understandand gloomy. A hacker’s profile can extend from a roguehigh-school teenager to an experienced professional.While some hackers have the chance to fructify theirknowledge in a legal environment, others gain theirliving following illegal activities. Nevertheless, they allshare a common passion for IT security and they havean important potential.As the modern cybercrime is continuously developingand turning into a financial motivating market, there is astrong need of reinforcements. We should give to everyIT-security talented person the opportunity to show theirskills and use them for a good cause. Why not use theirpassion in order to turn them to the right side.Current situationOver the last couple of years, an interesting trend isvisible in the world of IT: large companies start payingmoney to people who find vulnerabilities within theirproducts. For example, Mozilla has been rewardingpeople who found security weaknesses of their wellknownbrowser [3]. Google is also running a very wellpaid bounty program for their chrome browser and theirwebsites and are ready to pay important amounts ofmoney [4]. Facebook also adopted this new trend andstarted at the end of July 2011 to reward vulnerabilityresearchers [5].A possible explanation for this recent action maybe the fact that companies start to become aware ofthe potential skilfulness that hackers might possess.Consequently, the companies start to cooperate withthe hacker communities, instead of taking legal actionagainst them (like Sony did for example [6]).Considering that the cooperation between hackersand companies can stand while there is enough benefiton both sides, the startup Hatforce came up with anidea.The ideaHatforce.com came up with an idea which can becalled an open market crowd-sourcing platform forpenetration tests. The principle is simple: usingthe worldwide hacker community in order to findvulnerabilities in every IT system possible (websites,servers, software, etc.) and reward them for thevulnerabilities they found.05/2011 (5) SeptemberPage 36http://pentestmag.com