Who Hacks, and Why?
Before you can defend a system, you need to understand who is attacking it and what they want. The slides break hackers into five behavioral profiles — think of it as a spectrum from "helpful" to "destructive."
Mnemonic — "GASSI"
G-A-S-S-I: Good guys → Amateurs (script kiddies) → Suicide hackers → Suits... no wait, Criminals → Ideologues. Picture a staircase going from "helpful nerd" at the bottom to "burns it all down" at the top — that's roughly the escalation from Good Guys to Suicide Hackers, with Criminals (money) and Ideologues (politics) branching off to the side as the two "has a real-world motive" categories.
The Hacker Mindset
Slides list five psychological "excuses" hackers use to justify what they do — useful for understanding social engineering targets and insider threats too:
Victimless Crime
"I'm not physically hurting anyone" — a rationalization, not a legal defense.
Robin Hood Ideal
"I'm taking from the rich/powerful to help the little guy."
National Pride / Patriotism
Hacking framed as defending or promoting one's country.
Educational Value
"I'm just learning how systems work."
Curiosity
Simple desire to see "what's behind the door."
Motivations: Means, Opportunity, Motive (MOM)
An attack happens only when all three ingredients line up — this is the same triangle used in criminology.
skills & tools
access & timing
why bother
Mnemonic — "MOM lets the attack happen"
M-O-M = Means (can they?), Opportunity (is the door open?), Motive (do they want to?). Remove any one leg of the triangle and the attack doesn't happen — this is exactly how risk assessments justify prioritizing patches: kill the Opportunity even if Means and Motive exist.
Modern Hacking & Cybercriminals
- New threat categories: worms, spam, spyware, adware, rootkits.
- Shift from the lone hacker to organized groups of hackers.
- Crime rings, organized crime, and hostile nations use the internet as an attack route — cyberattacks as geopolitical tools.
- Hackers are increasingly financed by criminal organizations, terrorists, or foreign governments — hacking-as-a-service.
The TAP Principle of Controls
Every security control an organization deploys falls into one of three buckets. Auditors and pen testers use this to make sure no category is neglected.
Mnemonic — "TAP on the door"
T-A-P: imagine you Tap on a door — the Technical lock keeps it shut, the Administrative sign says "Authorized Personnel Only," and the Physical guard standing next to it stops you anyway. All three layers have to fail for someone to get through.
Ethical Hacking and Penetration Testing
Ethical hackers require explicit permission before they engage in penetration testing. Penetration testing is the structured and methodical process of investigating, uncovering, attacking, and reporting on a target system's strengths and vulnerabilities. Pen tests are commonly performed as part of IT audits.
Black-Box vs. White-Box vs. Gray-Box Testing
How much information the testing team is given up front defines the "color" of the test:
No knowledge of the system is given to the testers. Simulates exactly how a real external attacker sees the target.
Testers are given advanced/full knowledge of the system (source code, architecture, credentials) — deepest, fastest coverage.
Testers get partial knowledge — a middle ground that mimics an insider or a partially-privileged attacker.
Mnemonic — think of a house showing
Black = you're a burglar outside with zero floor plans. White = you're the architect with the blueprints. Gray = you're a guest who's been inside once. Darker box = less light = less info.
Audit vs. Vulnerability Assessment vs. Penetration Test
These three terms get confused constantly — here's the real distinction:
| Activity | Goal | Depth |
|---|---|---|
| Audit | Checks compliance against a standard/policy (paper trail) | Documentation-focused, often no exploitation |
| Vulnerability Assessment | Identifies and lists known weaknesses | Scans for flaws, does not typically exploit them |
| Penetration Test | Actively exploits weaknesses to prove real-world impact | Goes all the way: find it, exploit it, report it |
The Role of Ethical Hacking
Key Points When Playing the Ethical Hacker Role
- Requires permission of the victim/client (in writing — this is what makes it "ethical").
- Use the same strategies as a malicious hacker would.
- Use care to avoid actually harming the system.
- Establish clear rules of engagement before starting.
- Requires advance knowledge of real hacker techniques — you can't simulate what you don't understand.
Permission is everything
The single line separating "ethical hacker" from "criminal" is written authorization and a defined scope. Same techniques, same tools — different consent.
Ethical Hackers and the C-I-A Triad
Everything a pen tester attacks — and everything a defender protects — maps back to three core properties of information:
Systems that are easy to use tend to expose more surface area — fewer restrictions, more convenience.
Locking a system down tightly makes it safer but often harder and slower for legitimate users to work with.
There is an inherent trade-off: pushing security up usually pushes usability down, and vice-versa. Good design finds the acceptable middle point for the organization's risk tolerance.
Main Hacking Phases
Every attack — malicious or ethical — follows the same five-phase sequence. This is the backbone of the entire course; every later chapter is really a deep dive into one of these phases.
Reconnaissance
Passive/active information gathering about the target before touching it directly (covered in Chapter 2).
Scanning
Actively probing the target for live hosts, open ports, and services (Chapter 3).
Gaining Access
Exploiting discovered vulnerabilities to actually break into the system.
Maintaining Access
Installing backdoors/rootkits so the attacker can return without repeating earlier phases.
Clearing Tracks
Deleting logs and evidence to avoid detection and attribution.
Mnemonic — "Really Sneaky Guys Move Carefully"
R-S-G-M-C: Reconnaissance, Scanning, Gaining Access, Maintaining Access, Clearing Tracks. Picture a burglar who first cases the neighborhood (Recon), checks which windows are unlocked (Scanning), climbs in (Gaining Access), leaves a spare key under the mat (Maintaining Access), then wipes fingerprints on the way out (Clearing Tracks).
Types of Penetration Test Attacks
Just like the TAP controls, attacks during a pen test are classified into three categories that mirror the controls being tested:
Technical
Exploiting software/hardware — network attacks, exploits, malware.
Administrative
Testing whether policies are actually followed — social engineering, phishing.
Physical
Testing physical barriers — tailgating into a building, badge cloning, dumpster diving.
Skills of the Ethical Hacker
Slides emphasize that a good ethical hacker needs a mix of technical depth (networking, OS internals, programming, security tools) and non-technical skill (communication, report writing, ethics/discretion, staying within legal scope).
Laws, Ethical Standards & Certifications
The client places trust in the ethical hacker to use proper discretion. Breaking that trust can undermine confidence in every other part of the engagement, including the credibility of the final report.
Violating the agreed scope of testing can be sufficient cause for legal action — and if that violation causes actual damage, the client may be compelled to sue.
Relevant Laws & Standards
| Law / Standard | What it covers |
|---|---|
| Computer Fraud and Abuse Act (CFAA) | US federal law criminalizing unauthorized computer access. |
| US Electronic Communications Privacy Act | Protects the privacy of electronic communications (email, calls, stored data). |
| Sarbanes-Oxley Act (SOX) | Corporate financial reporting controls, including IT security implications. |
| FISMA 2014 | Federal Information Security Modernization Act — governs federal agency information security. |
Professional Certifications
| Certification | Issuer | Notes |
|---|---|---|
| CEH — Certified Ethical Hacker | EC-Council | Most widely recognized entry-level ethical hacking cert. |
| GPEN — GIAC Penetration Tester | SANS / GIAC | Hands-on penetration testing focus. |
| OSCP — Offensive Security Certified Professional | Offensive Security | Rigorous practical exam; highly respected in industry. |
| Mile2 certifications | Mile2 | Less well-known but budget alternative. |
| CISSP | (ISC)² | Not a penetration testing certificate — it's a general information security management certification. |
Watch the trap answer
Exam questions love to ask "which of these is a pen testing certification" and slip CISSP in as a distractor. CISSP ≠ pen testing.
Exam Tips & Tricks
Memorize the 5 phases in order
Reconnaissance → Scanning → Gaining Access → Maintaining Access → Clearing Tracks. Questions often ask "which phase comes after X."
Black = least info, White = most info
Gray-box sits in the middle. Don't mix up which "color" means "zero knowledge."
CISSP is NOT a pen test cert
It's a general security management certification — a favorite exam distractor.
Permission = the ethical line
The only technical difference between an ethical hacker and a criminal is written authorization and scope.
MOM = Means + Opportunity + Motive
All three must be present for an attack to occur — remove any one to reduce risk.
TAP = Technical / Administrative / Physical
Every control (and every pen-test attack type) fits one of these three buckets.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Good Guys | InfoSec pros who hack to secure systems |
| Script Kiddies | Amateurs using others' tools/scripts |
| Criminals | Hack for financial gain |
| Suicide Hackers | Aim for destruction, don't care about punishment |
| Ideologues / Hacktivists | Hack for political/ideological reasons |
| TAP Controls | Technical, Administrative, Physical |
| Hacker Mindset | Victimless crime, Robin Hood ideal, patriotism, education, curiosity |
| MOM | Means, Opportunity, Motive — all 3 needed for an attack |
| Ethical Hacker | Hacks with permission to find/report vulnerabilities |
| Penetration Testing | Structured process to investigate, attack, and report on a target's weaknesses |
| Black-Box Testing | No system knowledge given — simulates external attacker |
| White-Box Testing | Full/advanced knowledge given to testers |
| Gray-Box Testing | Partial knowledge given to testers |
| Audit | Compliance check against a standard, mostly paperwork |
| Vulnerability Assessment | Identifies weaknesses, doesn't exploit them |
| Penetration Test | Actively exploits weaknesses to prove impact |
| Role of Ethical Hacking | Use knowledge/skills → understand hacker mindset → simulate attacks |
| Key Points for Testers | Get permission, use same strategies, avoid harm, set rules of engagement, know attacker techniques |
| CIA Triad | Confidentiality, Integrity, Availability |
| Usability vs Security | Trade-off — more of one usually means less of the other |
| 5 Hacking Phases | Reconnaissance, Scanning, Gaining Access, Maintaining Access, Clearing Tracks |
| Types of Pen Test Attacks | Technical, Administrative, Physical |
| Trust | Client trusts tester's discretion; breaking it damages entire engagement's credibility |
| Legal Implications | Scope violations can trigger lawsuits, especially if damage occurs |
| CFAA | US law criminalizing unauthorized computer access |
| SOX | Corporate financial reporting/controls law |
| FISMA 2014 | Governs federal agency information security |
| CEH | Certified Ethical Hacker — EC-Council |
| GPEN | GIAC Penetration Tester — SANS |
| OSCP | Offensive Security Certified Professional |
| CISSP | General security cert — NOT a pen testing certification |