3 ms·

An ethical hacker will bring down the systems. Indeed I believe that whatever security is in place there is a possibility of a hack. So by using ethical hacker

An ethical hacker will bring down the systems. Indeed I believe that whatever security is in place there is a possibility of a hack. So by using ethical hacker you let the whole system die and see if company can recover or continue either with disaster recovery or paper based process or combination of multiple strategy. This is what I meant by ethical hacking service. Based on practical experience with the top consulting firms can say confidently besides security by obscurity and security practice which is a copy paste of some pre-defined strategy by so called their experts, almost none employ or pay ethical hackers to bring down their own security or process to show that their strategy works.

close04 7y ago
> you let the whole system die and see if company can recover or continue either with disaster recovery or paper based process or combination of multiple strategy. You're not describing a security breach scenario here but basically a disaster scenario. It's security vs. resiliency. I mean there are plenty of threat models to protect from, hackers trying to steal secrets, hackers trying to take down your systems, etc. But in the end security is about making sure you detect and/or stop the attacker, other processes take care of rebuilding after they took you down. So you wouldn't hire an ethical hacker to take down your systems but rather to identify weak points, exploit them, infiltrate the system and then possibly exfiltrate data. The aftermath of what the hacker did is something else entirely and will be dealt by your disaster recovery, business continuity processes, PR, etc.