From criminal pastime to cybersecurity tool: ethical hacking and other best security practices

In an era dominated by digital advancements and interconnected technologies, the cybersecurity landscape stands as the last line of defense against an ever-evolving array of threats. As we navigate the intricacies of the modern digital age, the importance of cybersecurity cannot be overstated. It serves as the guardian of our sensitive data, shielding individuals, businesses, and nations from malicious actors who seek to exploit vulnerabilities for various nefarious purposes.

One of the fundamental pillars of cybersecurity is Incident Response, a proactive strategy that prepares organizations to effectively mitigate the impact of security incidents. In a world where cyber threats are dynamic and sophisticated, having a robust Incident Response plan is akin to having a well-drilled emergency response team ready to tackle unforeseen challenges. Rapid identification, containment, eradication, and recovery are essential components of a successful Incident Response framework.

Equally critical is Threat Detection, the vigilant surveillance and identification of potential security breaches before they can wreak havoc. With cyber threats becoming increasingly stealthy and complex, the ability to detect anomalous activities and potential risks in real-time is a linchpin in any cybersecurity strategy. Advanced threat detection mechanisms leverage cutting-edge technologies such as artificial intelligence and machine learning to stay one step ahead of cyber adversaries.

To fortify the cybersecurity posture, organizations often turn to established frameworks that provide a structured approach to managing and enhancing security measures. Frameworks like NIST Cybersecurity Framework and ISO/IEC 27001 offer comprehensive guidelines for developing, implementing, monitoring, and improving cybersecurity policies and processes. These frameworks not only provide a roadmap for organizations but also facilitate a standardized language and approach in the ever-expanding realm of cybersecurity.

In this exploration of cybersecurity fundamentals, we delve into the intricate web of Incident Response, Threat Detection, and frameworks that collectively form the bedrock of a resilient cybersecurity strategy. As we navigate the digital frontier, understanding these essentials becomes not just a necessity but a proactive step towards safeguarding our digital future. Join us in unraveling the layers of cybersecurity intricacies and fortifying our collective defenses in the face of an evolving threat landscape.

The evolving threat landscape

A rise in cybercrime was forecasted for 2024, as cybercriminals became increasingly adept in utilizing generative AI for malicious purposes over the past year. Already, this year has seen several significant cybersecurity incidents.

France, for example, is facing the consequences of its biggest ever security breach, according to Yann Padova, a digital data protection lawyer and former Secretary General of the French data protection authority (CNIL).

The breach led to the personal data of over 33 million citizens (nearly half of France’s population) being leaked after two of the nation’s most prominent and trusted medical insurance providers, Viamedis and Almerys, were hacked at the beginning of February. As a result, the providers are facing crippling GDPR fines of up to $20 million each – and this could have been even more if the leaked data had been of a more sensitive nature.

This highlights the scale of disruption that a cyberattack can cause and demonstrates that no business, regardless of its size, clientele, or reputation, is immune to cybercrime in the current digital landscape that most businesses must inevitably operate in.

“The reputational impact of a data breach or security incident can be devastating, potentially leading to the loss of trust and business, not to mention disruption of operations. It’s not just about the data or the immediate impact; it’s also about the availability and integrity of services. Establishing a strong cybersecurity posture early on is both cost-effective and foundational for long-term success. While smaller organizations are continually optimizing for efficiency, a healthy investment in strong security foundations will build trust and avoid breaches.”

Joe Lea, CEO of Kivera

“Cybersecurity is a very important and worthwhile financial investment for businesses of all sizes. Smaller enterprises and startups often overlook the importance of cybersecurity and I have seen more than one case where a company was forced to cease operations due to a single cybersecurity incident.”

Gary Huestis, CEO of Powerhouse Forensics

“It is essential for businesses of all sizes to make an appropriate financial investment in cybersecurity protection. Not only is cybersecurity required by state, federal and foreign laws, but the reputational damage suffered from cyber-breaches and other unauthorized disclosures of sensitive data can hurt or even ruin a business.”

Paul Malie, Partner at Tucker Ellis LLP

Therefore, businesses of all sizes and sectors should utilize cybersecurity frameworks such as NIST’s Risk Management Framework, which provide free comprehensive guidance for both Threat Detection and Incident Response. By setting out five key functions (Identify, Protect, Detect, Respond, and Recover), this framework serves as a general and fundamental checklist that businesses can use to ensure that they have not left any obvious vulnerabilities of their systems exposed to attack.

Nevertheless, as the threat landscape evolves with the relentless innovation of cybercriminals, it is becoming increasingly difficult for businesses to ensure that their security protection remains effective and up to date.

To stay ahead of the game, it is critical that businesses are aware of how the cybersecurity landscape is evolving, and that they stay informed about the latest methods, resources, and tactics that cybercriminals are using. Currently, there are three key trends that businesses should be aware of.

1. AI is empowering cybercriminals by making it easier for them to send more accurate phishing emails in different languages, craft convincing deepfakes, and utilize coding software to bypass systems’ security protection such as data encryption. Cybercriminals’ increasing proficiency in their use of generative AI has also led to an emerging trend of FaaS (Fraud as a Service), where professional hacking services and AI-enabled malicious software can be purchased on the dark web and thus extended to a wider circle of bad actors.
2. With the advancement of AI capabilities, data has become a valuable asset that most companies are now using to increase their profits and optimize their business strategy. This has not only made data an increasingly sought-after commodity that cybercriminals can leverage to achieve their ultimate goals but has also increased the number of companies that cybercriminals might consider targets.
3. There are now increasing numbers of legitimate business accounts and identities that are available on the dark web, according to a recent report by IBM X-Force. The exploitation of legitimate accounts to log in to a company’s digital system is much more difficult for businesses to detect than traditional hacking methods, leaving them much more vulnerable to this form of attack, which 2023 saw become favored by cybercriminals as the path of least resistance.

The rise of ethical hacking

In view of the ever-changing cybersecurity landscape, which gives many cybersecurity tools a shelf life of just a few months, ethical hacking has emerged as one of the most powerful and reliable tools that businesses can use to keep their defenses up to date and healthy. It is also a useful tool for business strategy. According to Mick Baccio, cybersecurity expert at Splunk, ethical hacking “provides valuable information to Executive leaders about their environment to better inform business decisions”.

Through the regular and proactive security testing of their systems, CEOs can monitor the volatility of their data storage in an increasingly data-driven world, where breaches and data leaks have the power to not only cripple businesses but also expose the personal data of countless individuals on a national and even international scale.

The greatest strength of ethical hacking is that it enables businesses to harness the innovative mindset of a criminal hacker to enhance their security protection. This ultimately translates into a competitive advantage that can be marketed to clients.

Many businesses have already taken advantage of ethical hacking as a key cybersecurity tool, either by upskilling their existing security team with hacking skills, or by investing in the regular services of a professional.

“The benefit of outsourcing is it can be more cost-effective, and you are guaranteed expertise. If you attempt to give an existing employee this role or hire a new employee, you risk misconfiguration or sustainably increasing the costs to secure your data.”

Eddy Abou-Nemhe, CEO of RevNet Ottawa 

“Having outsiders look at it gives you access to a team that has seen the networks of numerous organizations. They know where the weak points are most likely located and how to move to them quickly. Having someone internal is also excellent because with insider knowledge, they will know exactly where the pain points are.”

Kyle Gaertner, Manager of Offensive Security Operations at Fortra

The decision to outsource or insource ethical hacking services really depends on a business’ longer term cybersecurity strategy. Businesses which plan on utilizing ethical hacking on a permanent, regular service will see a worthwhile ROI from investing in the training of their existing team, especially as the demand for cybersecurity professionals continues to grow.

Furthermore, companies with data of a very sensitive and high-profile nature may need to consider the potential risks associated with entrusting their systems to an external source.

According to Paul Malie from Tucker Ellis, outsourcing ethical hacking services “raises significant legal risks. One best practice to address these risks is for the company and ethical hacker to enter into a written agreement that clearly authorizes the ethical hacking, limits the scope of the hacking to prevent disclosure of sensitive data, and binds the ethical hacker to strict data privacy and security obligations with respect to the data it may successfully obtain.”

Businesses will also need to consider other company-specific factors such as the size and complexity of their digital system, budget constraints, and the current workload of their security team.

For many companies, using automation software such as Spunk’s SOAR tool and Sprinto are providing a cost-effective way of continuously monitoring the vulnerabilities of their systems, and can free up the time of their security team to increase vigilance and security for targeted areas of weakness.

“The shift I’ve seen with ethical hacking is towards more tooling and technology. With the increase of AI and automation, you can start to build tools that do similar things to an ethical hacker on a continual basis, such that you almost have a continuous dashboard that shows you, for example, what does my organization’s attack surface look like right now?”

Martin Borrett, Technical Director for IBM Security UK&I.

Nevertheless, given that AI software is being used to level up both sides of the cybersecurity game, businesses should not think of automated monitoring as a replacement for other tools such as ethical hacking, but simply as a way to reduce the workload of their security team. This is particularly crucial for businesses which are more likely to be victims of more mature and targeted attacks, which will easily find a way to bypass automated protection measures.

How to harness the criminal mindset for good

The ability to lean into the hacker mindset when assessing a business’ security risks is crucial to optimize the benefits of ethical hacking. While it is not usually possible to predict the motivation behind a cyberattack, business should remember that cybercriminals primarily operate on an opportunistic basis. Typically, this means that the greatest threat to a business’ digital system comes from the inevitable lapses in judgement and vigilance that occur within the natural margins of human error.

In a comment about the last year’s cyberattack on the British Library, Mick Baccio highlights the importance of maintaining basic security measures and digital hygiene: “Ransomware groups like Rhysida are more opportunistic than concerted, so any vulnerability that exists in the entirety of the British Library technical ecosystem could have been leveraged. I think any security posture starts with MFA – multi factor authentication, for accounts that use webmail, VPN, and accounts that access critical systems.”

But lapses in vigilance aren’t the only things that cybercriminals are on the lookout for. Just like businesses, they are out for the biggest ROI from their efforts, and the path of least resistance for entry to a security system. For example, IBM’s X-Force Report found that cybercriminals are more likely to attack systems which utilize common AI software because it makes hacking the software more worthwhile.

In the IBM X-Force Report, there is an explanation for what cybercriminals will be likely looking for to access the effectiveness of their hacking activity. ‘For cybercriminals to see ROI from attacking AI platforms and for developing easy-to-use tools on the criminal underground, the technology they’re targeting must be ubiquitous across most organizations in the world. Otherwise, cybercrime attacks would require too much time and money, negatively impacting profits. Defenders should consider the AI market share as an indicator for the AI attack surface’s maturity.’

Another factor that cybercriminals are likely to evaluate when considering potential targets is the type and quantity of data that can be gleaned from a digital system. Eddy, Joe, and Kyle share their expertise on what you can expect hackers to consider when looking at the data sets, types, infrastructure, and access to the various types of data.

“Some businesses hold both their own proprietary data and consumers’ personal information. In these cases, the security risks may be even higher, as hackers deem access to their internal systems and all of this information as more valuable.”

Eddy Abou-Nemhe, CEO of RevNet Ottawa.

“Attackers target specific industries where they perceive the potential for a higher “bang for their buck” whether that is for financial gain or disruption of operations for political gain. That said, regulated industries, such as healthcare or finance along with government organizations, with more sensitive data, face heightened risks because of the potential payoff from successful attacks on these sectors.”

Joe Lea, CEO of Kivera.

“For large businesses, the stakes are definitely higher due to the higher likelihood of there being more possible points of entry for attackers, possibility of a larger amount of data to steal or ransom, and with those two factors, it would be a more desirable target for attackers.”

Kyle Gaertner, Manager of Offensive Security Operations at Fortra.

Being aware of considerations such as these, which affect both the likelihood and the maturity of an attack, can help businesses see where their pain points are, and help them restructure their systems and/or improve their incident response strategy to become more resilient against cybercrime.

Furthermore, harnessing the mindset of a cybercriminal is especially critical given the current trend of cybercriminals gaining valid access to systems via existing user accounts whose credentials are available on the dark web. When a system has been illicitly accessed through a valid account, there is no easy way to detect it, and cybercriminals can thus gain easy and undetected access to a system for days, weeks or even months. Criminal abuse of a valid user account can however be detected through UBA (user behavior analytics), which monitor an account’s activity and compare it to standard user behavior.

“In mature organizations, these tools look at the activity and behaviors of users, asking questions such as what sort of data access are they performing? Where is that data going? Is it being sent to an organization that we don’t do business with? For legitimate users going about their business, if they’re outside the parameters that separate suspicious activity from unsuspicious activity, they’re going to be detected and investigated”

Martin Borrett, Technical Director for IBM Security UK&I

In these cases, having an awareness of the likely goals and behaviors of cybercriminals is key to improving accuracy in detecting suspicious account activity, and being able to predict the actions that a cybercriminal would take once they had gained access to a business’ digital system.

Having secure infrastructure for Rising Amounts of Data

In the ever-expanding digital landscape, businesses are strategically restructuring their operations to effectively handle the surge in data, both internal and external. This involves the implementation of robust data management systems, cloud infrastructure, and scalable technologies.

Companies are increasingly adopting a data-centric approach, organizing their processes to accommodate the growing volumes of information. This not only enhances operational efficiency but also plays a crucial role in future-proofing security measures. By understanding the flow of data within the organization, companies can implement more targeted and effective security protocols.

Investment in Advanced Security Tools

As the threat landscape evolves, organizations are making significant investments in cutting-edge tools to prevent data leaks and breaches. This includes deploying advanced encryption methods, intrusion detection systems, and threat intelligence platforms.

By embracing state-of-the-art technologies, companies can create a formidable defense against cyber threats. These investments not only serve as proactive measures but also contribute to future-proofing security frameworks. However, it’s essential to strike a balance between innovation and practicality, ensuring that the chosen tools align with the specific needs and vulnerabilities of the business.

Prioritizing employee training

Recognizing that a chain is only as strong as its weakest link, companies are increasingly investing in training programs to educate employees on cybersecurity best practices. Human error remains a significant factor in security breaches, and a well-informed workforce acts as a crucial line of defense.

Vivek Dodd, CEO of Skillcast explains: “Staff vulnerabilities, stemming from gaps in knowledge or lapses in judgment, often function as the weakest link in the security chain. While tools like firewalls and antivirus software offer crucial defense layers, their efficacy relies heavily on the vigilance and awareness of personnel. All too often, training is poorly conducted, rushed through, or delivered in an unengaging manner, serving as a checkbox exercise to demonstrate compliance. This approach undermines the true purpose of training and fails to instill a genuine understanding of cybersecurity risks and how to deal with them.”

Effective training initiatives should therefore communicate to employees the importance of cybersecurity protection, the nature of risks in the evolving digital landscape, and key vulnerabilities that are company-or at least sector-specific. Training should also be comprehensive and cover a spectrum of topics including recognizing phishing attempts, practicing secure password management, and understanding the importance of data confidentiality. By fostering a security-conscious culture, organizations can reduce the likelihood of internal vulnerabilities and create an environment where employees actively contribute to the company’s overall security posture.

Navigating the Costs of Security

While the imperative for robust security measures is clear, organizations must also grapple with the associated costs and their impact on financial metrics. Investing in advanced security tools, employee training programs, and structural adaptations requires a significant allocation of resources. Companies must carefully assess the trade-offs between safeguarding their digital assets and maintaining healthy profit margins. Striking this balance is crucial for long-term sustainability, as excessive security costs can erode profitability. Understanding the relationship between security investments and their impact on revenue, margins, and overall costs is essential for informed decision-making and ensuring a resilient and future-proofed security infrastructure.

Final thoughts for a robust cybersecurity strategy

In the 2024 cyber threat landscape, businesses are navigating a complex realm where cybercriminals leverage generative AI for malicious purposes, leading to significant security breaches. The aftermath of France’s largest security breach, exposing the personal data of over 33 million citizens, underscores the pervasive and indiscriminate nature of cyber threats. This incident emphasizes the critical need for organizations, irrespective of size or reputation, to fortify their cybersecurity posture through frameworks like NIST Cybersecurity Framework and ISO/IEC 27001, offering structured guidelines for developing, implementing, monitoring, and improving cybersecurity policies.

A pivotal element in the cybersecurity arsenal is ethical hacking, emerging as a powerful tool for businesses to proactively test and enhance their defenses. Ethical hacking not only provides valuable insights into potential vulnerabilities but also enables organizations to stay ahead in the cat-and-mouse game with cyber adversaries. As businesses grapple with the evolving threat landscape, they face the decision of whether to insource or outsource ethical hacking services. The choice depends on the organization’s long-term cybersecurity strategy, considering factors such as the size and complexity of their digital systems, budget constraints, and the sensitivity of their data. In response to the dynamic and sophisticated nature of cyber threats, companies are also investing in advanced security tools, prioritizing employee training, and restructuring their operations to handle the surge in data. These strategic initiatives, including the implementation of robust data management systems and the adoption of a data-centric approach, contribute to future-proofing security measures. As businesses navigate the costs associated with security, a delicate balance between safeguarding digital assets and maintaining healthy profit margins becomes crucial for long-term sustainability.