How To Hire A Hacker - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
IT Leadership // Team Building & Staffing
News
6/28/2012
01:15 PM
Connect Directly
LinkedIn
RSS
E-Mail
100%
0%

How To Hire A Hacker

Hackers might have shady pasts, but they can also bring a lot of IT expertise to the table. Should you consider hiring one?

Who Is Anonymous: 10 Key Facts
Who Is Anonymous: 10 Key Facts
(click image for larger view and for slideshow)
They're the bane of the IT security professional's existence when they're on the wrong side of the law, but the truth is, hackers often understand the nuances of network security better than your average CSO. So is it safe to bring a hacker into your IT team?

According to Shane MacDougall, there are pros and cons to hiring a hacker. MacDougall is a partner at Canadian security consultancy Tactical Intelligence, a hacker at the DEFCON Hacking Conference, and last year's winner of Social-Engineer.org's The Schmooze Strikes Back hacking contest.

"Every IT department needs to hire an ethical hacker," says MacDougall. But his advice comes with a warning: "You really do need to check the background on who these people are, who they've been hanging with, and who their crews are." MacDougall offers these tips for hiring a hacker that's right for your IT shop:

Ensure a good fit. No two hackers' skill sets are exactly the same. For this reason, MacDougall recommends that you carefully consider why you need to hire someone in the first place.

For example, if your company is focused on programming, MacDougall says, "Somebody who has a lot of background in breaking applications is a desired skill." On the other hand, a network operations center might look for a network ninja who is handy with lots of network sniffing tools. Finally, if your company needs a systems administrator, a hacker who has broken into systems and who knows how to find the holes within various servers and where vulnerabilities exist might be the best bet. "They're all very unique jobs and they all take very unique skill sets," says MacDougall.

[ Read more about the government's use of malware for security purposes. See Was U.S. Government's Stuxnet Brag A Mistake? ]

Be prepared to embrace open source. Most hackers are open source enthusiasts--a plus for companies who need to stretch IT resources. "It's advantageous to have someone who is familiar with open source tools because they're a lot easier to deploy in a lot of organizations, and it can make a company a lot more agile in terms of software development and network administration," says MacDougall.

Still, for hackers to put their open source skills to good use, MacDougall says, "It's critical that senior management has bought into open source or that you have a visionary CTO or CIO who says open source is the way we want to go." Without this leap of faith on the part of an IT leader, according to MacDougall, a hacker's open source prowess will simply go to waste.

Limit time spent underground. One of the most impressive things a hacker can bring to the table is access to an elite--and often underground--network of IT whiz kids. But while this brain trust can prove useful, MacDougall warns, "If the hacker is involved in the underground scene and frequents a lot of forums and IRC chats, you still need to be very cautious. You can get a lot of blowback."

For example, MacDougall points to the hacker who spends hours plumbing forums for tidbits on "zero-day" attacks. "I have to seriously question the value of spending all that time underground," he says. Rather, simply paying for services that track traffic and monitor data logs frees up a hacker for more important tasks.

Revel in the D.I.Y. spirit. Years spent breaking down systems and cracking passwords teach hackers a thing or two about being resourceful. This is just the type of scrappiness that cost-conscious IT shops will appreciate. After all, says MacDougall, "A lot of freeware and open source programs can let small IT teams do a lot on a fairly small budget."

Test for authenticity. Checking references isn't always an option when it comes to hiring a hacker. "It's a judgement call," warns MacDougall. "You have to tread very carefully, especially if that someone professes to be a hacker--a good hacker is never going to tell you that they're a hacker. How many bank robbers introduce themselves as a bank robber?" Instead, MacDougall advises using online hacker challenges to test a prospect's breaking and cracking skills.

Black Hat USA Las Vegas, the premiere conference on information security, features four days of deep technical training followed by two days of presentations from speakers discussing their latest research around a broad range of security topics. At Caesars Palace in Las Vegas, July 21-26. Register today.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 4   >   >>
Mr Jame1
100%
0%
Mr Jame1,
User Rank: Apprentice
7/24/2019 | 6:07:20 PM
Pending Review
This comment is waiting for review by our moderators.
doncan115
50%
50%
doncan115,
User Rank: Apprentice
7/21/2019 | 2:04:19 AM
Pending Review
This comment is waiting for review by our moderators.
Jonzy
50%
50%
Jonzy,
User Rank: Apprentice
6/18/2019 | 7:40:06 AM
Pending Review
This comment is waiting for review by our moderators.
Aurnia Eamon
0%
100%
Aurnia Eamon,
User Rank: Apprentice
3/15/2019 | 8:32:13 PM
Pending Review
This comment is waiting for review by our moderators.
salinafimbres
50%
50%
salinafimbres,
User Rank: Apprentice
1/16/2019 | 5:45:30 PM
Pending Review
This comment is waiting for review by our moderators.
JeffreyCampbell
50%
50%
JeffreyCampbell,
User Rank: Apprentice
12/28/2018 | 7:59:47 AM
Pending Review
This comment is waiting for review by our moderators.
mirnamcfaul
50%
50%
mirnamcfaul,
User Rank: Apprentice
12/14/2018 | 8:44:50 PM
Pending Review
This comment is waiting for review by our moderators.
JeffreyCampbell
50%
50%
JeffreyCampbell,
User Rank: Apprentice
12/13/2018 | 11:30:00 PM
Pending Review
This comment is waiting for review by our moderators.
JeffreyCampbell
50%
50%
JeffreyCampbell,
User Rank: Apprentice
12/8/2018 | 3:00:06 PM
Pending Review
This comment is waiting for review by our moderators.
JeffreyCampbell
50%
50%
JeffreyCampbell,
User Rank: Apprentice
12/8/2018 | 2:59:50 PM
Pending Review
This comment is waiting for review by our moderators.
Page 1 / 4   >   >>
Commentary
Enterprise Guide to Edge Computing
Cathleen Gagne, Managing Editor, InformationWeek,  10/15/2019
News
Rethinking IT: Tech Investments that Drive Business Growth
Jessica Davis, Senior Editor, Enterprise Apps,  10/3/2019
Slideshows
IT Careers: 12 Job Skills in Demand for 2020
Cynthia Harvey, Freelance Journalist, InformationWeek,  10/1/2019
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Getting Started With Emerging Technologies
Looking to help your enterprise IT team ease the stress of putting new/emerging technologies such as AI, machine learning and IoT to work for their organizations? There are a few ways to get off on the right foot. In this report we share some expert advice on how to approach some of these seemingly daunting tech challenges.
Slideshows
Flash Poll