Ethical hacking

Ethical hacking means attacking a computer system the way a criminal would, but with the owner’s permission and one goal: find the holes and get them fixed. The techniques are identical. The difference is the agreement, who gets the report, and that nothing is stolen or broken along the way.

In practice it takes several forms. A pentest is a scoped engagement against specific systems. A bug bounty programme lets anyone hunt for flaws and get paid per finding. Responsible disclosure is when someone stumbles on a hole by accident and reports it to the owner instead of exploiting it.

Permission is the line between ethical and criminal hacking. Without an agreement, gaining access to someone else’s system is a crime under Norwegian law, however good the intentions. That is why every engagement I take starts with a written agreement that says what will be tested, when, and what I am allowed to do once I get in.

This is what I do for a living, and it is what I show on stage. When an audience watches a phishing email, a forgotten test server or a reused password let me in, the lesson sticks better than any security poster. Someone who does ethical hacking is called an ethical hacker, and most people find their way into the field through curiosity, CTF competitions and a lot of practice on their own systems.

See also:See talks on digital securityRead: how I became an ethical hacker