CYS405 · Chapter 1 · Annotated SlidesIntroduction to Ethical Hacking and Penetration Testing
Original
Overview

Introduction to Ethical Hacking and Penetration Testing

Hacker profiles and motives, the TAP principle of controls, ethical hacking vs. penetration testing vs. audits and vulnerability assessments, ethical hackers and the CIA triad, the five hacking phases, the skills and ethics of a pen tester, laws and certifications.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 30 slides
  1. 1 Slide 1
  2. 2 Learning Objective
  3. 3 Key Concepts
  4. 4 Profiles and Motives of Different Types of Hackers
  5. 5 TAP Principle of Controls
  6. 6 The Hacker Mindset
  7. 7 Motivations
  8. 8 Modern Hacking and Cybercriminals
  9. 9 Ethical Hacking and Penetration Testing
  10. 10 Ethical Hacking and Penetration Testing (Cont.)
  11. 11 Comparison among Audit, Vulnerability Assessment and Pen Testing
  12. 12 Role of Ethical Hacking
  13. 13 Role of Ethical Hacking (Cont.)
  14. 14 Slide 14
  15. 15 Ethical Hackers and the C-I-A Triad: The C-I-A Triad
  16. 16 Ethical Hackers and the C-I-A Triad: Usability vs. Security
  17. 17 Main Hacking Phases
  18. 18 1- Reconnaissance
  19. 19 2- Scanning
  20. 20 3- Gaining Access
  21. 21 4- Maintaining Access
  22. 22 5- Clearing Tracks
  23. 23 Slide 23
  24. 24 Skills of the Ethical Hacker
  25. 25 Performing a Penetration Test: Ethical Hacking Steps
  26. 26 Performing a Penetration Test (Cont.)
  27. 27 Laws and Ethical Standards
  28. 28 Laws and Ethical Standards (Cont.)
  29. 29 Certifications
  30. 30 Summary
Slide 1 / 30

Slide 1

Slide 1: Slide 1
Slide 2 / 30

Learning Objective

Slide 2: Learning Objective
Slide 3 / 30

Key Concepts

Slide 3: Key Concepts
Slide 4 / 30

Profiles and Motives of Different Types of Hackers

Slide 4: Profiles and Motives of Different Types of Hackers

Notes

  1. Hat colours: black hat (malicious), white hat (authorized, ethical), gray hat (in between, may act without permission). Also script kiddies, hacktivists, suicide hackers, state-sponsored, cyber terrorists.

Exam angle

PredictionQ1

A hacker who works with the owner’s permission to find weaknesses is a:

Slide 5 / 30

TAP Principle of Controls

Slide 5: TAP Principle of Controls
Slide 6 / 30

The Hacker Mindset

Slide 6: The Hacker Mindset
Slide 7 / 30

Motivations

Slide 7: Motivations
Slide 8 / 30

Modern Hacking and Cybercriminals

Slide 8: Modern Hacking and Cybercriminals
Slide 9 / 30

Ethical Hacking and Penetration Testing

Slide 9: Ethical Hacking and Penetration Testing

Notes

  1. Ethical hacking = authorized hacking to find and fix weaknesses before attackers do. A pen test simulates a real attack within an agreed scope.

Exam angle

PredictionQ1

The key difference between an ethical hacker and a criminal hacker is permission (authorization).

Slide 10 / 30

Ethical Hacking and Penetration Testing (Cont.)

Slide 10: Ethical Hacking and Penetration Testing (Cont.)
Slide 11 / 30

Comparison among Audit, Vulnerability Assessment and Pen Testing

Slide 11: Comparison among Audit, Vulnerability Assessment and Pen Testing

Notes

  1. Audit: checks compliance with a standard. Vulnerability assessment: finds and lists weaknesses. Pen test: actually exploits them to prove impact.

  2. Trap A vulnerability assessment does NOT exploit; a penetration test does.

Exam angle

PredictionQ1

Which activity actually exploits weaknesses to show their impact?

Slide 12 / 30

Role of Ethical Hacking

Slide 12: Role of Ethical Hacking
Slide 13 / 30

Role of Ethical Hacking (Cont.)

Slide 13: Role of Ethical Hacking (Cont.)
Slide 14 / 30

Slide 14

Slide 14: Slide 14
Slide 15 / 30

Ethical Hackers and the C-I-A Triad: The C-I-A Triad

Slide 15: Ethical Hackers and the C-I-A Triad: The C-I-A Triad

Notes

  1. Attacks map onto the CIA triad: disclosure (confidentiality), alteration (integrity), denial (availability), the DAD triad.

Exam angle

PredictionQ1

A DoS attack targets:

Slide 16 / 30

Ethical Hackers and the C-I-A Triad: Usability vs. Security

Slide 16: Ethical Hackers and the C-I-A Triad: Usability vs. Security
Slide 17 / 30

Main Hacking Phases

Slide 17: Main Hacking Phases

Notes

  1. Tip Five phases: 1 Reconnaissance → 2 Scanning → 3 Gaining access → 4 Maintaining access → 5 Clearing tracks.

Slide 18 / 30

1- Reconnaissance

Slide 18: 1- Reconnaissance

Exam angle

PredictionQ1

Searching the target’s website and news articles without touching their systems is:

Slide 19 / 30

2- Scanning

Slide 19: 2- Scanning

Notes

  1. Scanning: probe the network for live hosts, open ports, services and vulnerabilities.

Slide 20 / 30

3- Gaining Access

Slide 20: 3- Gaining Access
Slide 21 / 30

4- Maintaining Access

Slide 21: 4- Maintaining Access

Notes

  1. Maintaining access: backdoors, rootkits, Trojans to come back later.

Slide 22 / 30

5- Clearing Tracks

Slide 22: 5- Clearing Tracks

Exam angle

PredictionQ1

Deleting log entries happens in which phase?

Slide 23 / 30

Slide 23

Slide 23: Slide 23
Slide 24 / 30

Skills of the Ethical Hacker

Slide 24: Skills of the Ethical Hacker
Slide 25 / 30

Performing a Penetration Test: Ethical Hacking Steps

Slide 25: Performing a Penetration Test: Ethical Hacking Steps

Notes

  1. Before testing: written permission (contract), scope, rules of engagement, NDA. Test types: black box (no knowledge), white box (full knowledge), gray box (partial).

Exam angle

PredictionQ1

A test where the tester has no prior knowledge of the target is:

PredictionQ2

An ethical hacker may start testing once the scope is agreed verbally.

Slide 26 / 30

Performing a Penetration Test (Cont.)

Slide 26: Performing a Penetration Test (Cont.)
Slide 27 / 30

Laws and Ethical Standards

Slide 27: Laws and Ethical Standards

Notes

  1. Laws (e.g. computer-misuse acts) make unauthorized access a crime regardless of intent.

Slide 28 / 30

Laws and Ethical Standards (Cont.)

Slide 28: Laws and Ethical Standards (Cont.)
Slide 29 / 30

Certifications

Slide 29: Certifications
Slide 30 / 30

Summary

Slide 30: Summary