a VM: virtual machine.
b Mbps: megabits per second.
c CPU: central processing unit.
Software and services used on the targeted machine.
| Version | Description |
PHP | PHP v8.1.0 | PHP is a hypertext preprocessor, ie, a scripting language on a server, which is used by OpenEMR . |
Apache2 | Apache v2.0 | Apache is the most popular web server software for building a website. In the targeted host, it is used by OpenEMR. |
MySQL | MySQL v5.7.17 | MySQL is one of the most popular relational database management systems. It has a small volume, high speed, and low maintainable cost, which is used by OpenEMR. |
MySQL | MySQL v5.7.17 | MySQL is one of the most popular relational database management systems. It has a small volume, high speed, and low maintainable cost, which is used by OpenEMR. |
OpenEMR | OpenEMR v6.0.0 | OpenEMR is an open-source electronic medical record system. In the targeted host, it is used to simulate a medical worker’s machine. |
Vsftp | Vsftp v3.0.3 | Vsftp provides a designedly open port installed for the experiment environment. It has many dangerous vulnerabilities. |
OpenSSH-server | OpenSSH-server v1.8.2 | OpenSSH-server provides a designedly open port installed in the experiment environment. It has many dangerous vulnerabilities. |
a OpenEMR: open-source electronic medical record.
As part of our experiment, we adapted the NIST ethical hacking framework [ 38 ] and follow the core planning, discovery, attack, and reporting modules. We first set up a simulation environment by implementing an OpenEMR system and then launched ethical hacking to exploit the vulnerabilities of the simulated HIS.
In our HIS simulation platform, we implemented OpenEMR. Overall, OpenEMR is a complex system with key functionalities, including practice management, EMR management, scheduling, electronic billing, prescribing, a patient portal, and a clinical decision support system, and has a complex database of more than 100 tables. We purposefully chose to implement this HIS because it supports a comprehensive security risk-management scheme based on the Health Insurance Portability and Accountability Act and NIST standards [ 43 ]. In addition, it is certified by the Office of the National Coordinator for Health Information Technology, which can run on different platforms such as Windows, Linux, and Mac OS X, and it is the most widely adopted HIS [ 44 ].
Our adaptation of the NIST ethical hacking framework [ 38 ] consisted of following 6 modules: scanning, discovery, exploitation, optimization, reporting, and control. In other words, we used the original NIST modules, but further enhanced them with 2 additional modules: optimization and control. Table 3 summarizes the key activities of each stage.
Key activities and the National Institute of Standards and Technology (NIST) method coverage of the (artificial intelligence [AI]–based) ethical hacking method.
(AI-based) ethical hacking stages | Key activities | NIST method stages |
Scanning | Use the Nmap scanning tool to identify the number of ports, port status, protocol, and operating system | Planning discovery |
Discovery | Use the Xray scanning tool to identify vulnerabilities | Planning discovery |
Exploiting | Use attacking tools (eg, SQLMap and Metasploit) to probe networks, applications, and database-related flaws and vulnerabilities | Attack |
Optimizing (optional) | Optimize attack paths using AI (eg, ACO ) | Discovery attack |
Controlling | Coordinate the modules to launch attacks and set ethical hacking preferences | Planning discovery attack |
Reporting | Collect and report results on the exploit | Reporting |
a Nmap: Network Mapper.
b ACO: ant colony optimization.
We conducted a comparative experiment between AI-based and non–AI-based ethical hacking methods. Although the AI-based experiment followed the 6 stages of the ethical hacking method as indicated above, the non–AI-based experiment followed the same method without executing the optimization module. Optimized and unoptimized penetration tests were performed 50 times to reduce the uncertainty caused by the simulation environment. In each run, information on the time, the number of exploits, and the number of successful exploits were recorded and compared.
Generally, the results from each module were first recorded and then used in each subsequent module. Figure 1 shows the interactions between different modules and the results from each module.
Interactions between different modules.
As part of the scanning module, we scanned the host information of the targeted machine, including the port, operating system, and installed service of the targeted machine. Nmap was used as a scanning tool to collect this information. Other similar tools included ZMap and Masscan. ZMap has an accuracy rate similar to that of NMap, but its computational time is higher [ 40 ]. Masscan is faster, but its accuracy rate is lower, particularly when the scanning area increases [ 40 ]. Therefore, we selected Nmap because of its accuracy and efficiency (computational time) and because it has more than 200 extension scripts for scanning.
We developed the following 2 versions of Nmap scanning scripts: the first was used for a single IP address and the other was used for an IP address segment. For a single IP address, Nmap scanning imports the IP from the control modules, checks whether the host is alive, and then scans and reports the results. For an IP address segment, the tool adopts multithreading to support multiple IP addresses in an IP address segment, and, as in the previous case, it then scans and reports the results.
This module focuses on obtaining vulnerability-related information of the target host. Existing vulnerability scanning tools include Nessus, NexSpose, and Xray. Although Nessus and Nexpose have a Metasploit application programming interface, and their vulnerability data set is one of the largest for vulnerability scanning, they are costly, and the education version has a limited number of vulnerabilities and ports.
In this study, Xray was selected for vulnerability scanning using the basic crawler method. Xray is a free vulnerability scanning tool, and their performance is comparable to that of Nessus and Nexpose. Xray supports diverse operating systems such as Windows, Linux, and Mac. As a passive scanning tool, it is much faster than active scanning because the latter requires sending requests to the targeted host and waiting for a response. Passive scanning is also challenging to detect using a targeted host. Xray also supports the use of web scanning. The Xray output is a JSON file that contains the type, payload, and target of the vulnerability. Because the targeted machine is an HIS using OpenEMR, the web scanning module can help detect vulnerabilities in OpenEMR.
This module launches attacks on the targeted host by leveraging the information gathered in the previous modules. This module applies ethical hacking tools, namely, SQLMap and Metasploit. Many exploiting tools provide similar performance and functionalities; however, we selected Metasploit as the primary attack tool because it is the most powerful and widely used tool in the field. This tool integrates several application programming interfaces that can be used for manual and automated exploitation using predefined settings. When conducting a manual penetration test, the tester must set up the targeted information and tools used for exploitation. The exploitation procedure is replaced by a resource scripts file that configures the Metasploit when using automated scripts. In our study, we imported output files from Nmap and Xray, ran automated exploits, and extracted the exploitation results.
In addition, as the database is an essential component of the HIS, attacks should be launched as part of ethical hacking, and the vulnerabilities of the database should be exploited. For this purpose, we used SQLMap to conduct attacks on a database that launches attacks by executing malicious SQL commands in the web input. It supports 5 types of SQL injections and can launch other types of exploits, such as XSS (cross-site scripting) injection [ 45 ]. By exploiting database vulnerabilities using SQLMap, the attacker can tamper with or steal digital data and information, remotely control the database, crash the hard disk, and control the system using Trojan viruses [ 46 ]. However, this behavior does not damage the targeted host, which is essential because the penetration test aims to enhance security rather than destroy the system. In our experiment, SQLMap imported the JSON output file from Xray and retrieved the URL for SQL injection. It then launched the attack automatically and exported a file using exploitation results.
For the optimizing module, we used ACO as the optimization algorithm for the optimization module. ACO simulates the behavior of ants to identify the shortest path(s) and pheromone-based communication within the colony. Attack path analysis is a core aspect of ethical hacking optimization. In ethical hacking, the goal is to attack the targeted machine using known paths, and the objective is to identify the shortest or fastest path to achieve this. The most common example of using ACO is to solve the TSP, where the shortest or fastest path is searched for by a salesman to deliver goods in all cities by exploring various paths and visiting each city exactly once. Ethical hacking has a similar goal, whereby the objective is to attack the targeted machine by exploiting as few known vulnerabilities as possible to successfully and swiftly complete the attack. Various paths between the origin and target machines can be built by combining exploits and finding the shortest or fastest way to do so. Textbox 1 demonstrates the optimization procedure for ACO.
NumIters (NumIters >0) # the maximum number of iterations,
NumAnts (NumAnts >0) # the maximum number of ants,
VulnerList # the vulnerability exploits list.
The best path (BestPath) is exported.
1: BestPath ← 0; BestPathDist ← 99999999;
2: For k← 1: NumIters do
3: LocalBestPath ← 0; LocalBestPathDist ← 99999999; # local best path for a single iteration
4: PheromCons ← zeros([][]); # matrix of pheromone concentrations for all pairs of ants.
5: For i← 1: NumAnts do
6: Vulner_i = VulnerList[i];
7: For j← 1: NumAnts do
8: Vulner_j = VulnerList[j];
9: p_ij=compute_Pij(Vulner_i, Vulner_j); # transition probability for pair (i,j).
10: CurrentPath_ij=computeProbablePath(p_ij, Vulner_i, Vulner_j); # path for pair (i,j)
11: CurrentPathDist=computerPathDist(CurrentPath_ij); # distance for path (i,j).
12: PheromCons(i,j) = updatePheromCons(CurrentPath_ij); # update of pheromon matrix
13: If (CurrentPathDist<LocalBestPathDist)
14: LocalBestPath=CurrentPath; # update of the shortest local path
15: LocalPathDist=CurrentPathDist; # update of the shortest local path distance
17: End for #NumAnts with j index
18: End for #NumAnts with i index
19: If (LocalBestPathDist<BestPathDist)
20: BestPath=LocalBestPath; # update of the shortest global path
21: BestPathDist=LocalBestPathDist; # update of the shortest global path distance
23: End for #NumIters
24: return BestPath
where Q is a constant and L k is the length of the k th ant tour.
The transition probability for each pair of nodes i and j for the k th ant can then be computed as follows:
where allowed is the set of not yet visited nodes, α is the weight of the pheromone, and β is the weight of the heuristic value [ 23 ]; here, they are set to α=.7 and β=.7, as suggested in Liu et al [ 47 ].
Each successful use of an exploit increases the concentration of pheromones for a pair of exploits that are connected successfully.
An ant explores a set of nodes vulnerabilities presented in a matrix in an attempt to construct a successful exploitation path. Whenever a successful exploitation is recorded, the current successful path is compared with the global best path found in all runs thus far and updated every time a shorter path is found.
The end condition for each literation was whether all the ants visited all the nodes in the vulnerability matrix. When all iterations have finished, ACO ends and provides results on the global best path.
After the final iteration, the optimization module reports the list of attack paths and prioritizes the paths with the highest pheromone concentration. The output was then stored as a *.csv file, titled “ant_output.csv,” which contains information on the common vulnerabilities and exposures, exploit, and used payload.
The controlling module imports the results produced from the previous modules, and it is necessary to conduct ethical hacking and launch attacks. Users can control the penetration test via an interactive user interface and set the targeted machine’s IP address or IP address segment of the targeted machine. The module then transmits this information to the information and vulnerability scanning modules. Once the scanning module is completed, users have to decide whether optimization is needed, and based on their decision, the optimization module will be triggered. This, in turn, calls the exploiting module to launch the attack on the targeted host. At the end of the procedure, this module sends its results to the reporting module, recording the time required to carry out ethical hacking for each module.
The reporting module collected the results of ethical hacking. Two sets of results (.csv files) were generated. The first set reports the time used for each module and the number and success rate of the launched exploits. This information can also be used to evaluate the performance of the algorithm in the optimization module. The second set of results contains information regarding the vulnerabilities themselves and can help users understand the targeted host’s security status and, therefore, act accordingly. Figure 2 summarizes the execution of the ethical hacking framework.
Flowchart of the ethical hacking framework. ACO: ant colony optimization.
As our research does not involve human participants directly or indirectly (eg, observations of public behaviors or secondary analyses of research data), ethics approval, informed consent, and compensation for human participants research were not required. In addition, the design of our study was based on simulations conducted within an experimental setting; as such, it did not raise any privacy or confidentiality concerns.
We performed AI-based (optimized) and non–AI-based (unoptimized) ethical hacking on the target machine (host IP 192.168.1.44). The AI-based experiment followed the novel ethical hacking framework (see the Methods section). The non–AI-based experiment followed the same method but omitted the optimization module. Table 4 shows the key activities across the different modules according to the proposed 6-stage ethical hacking method.
Key activities for the experiment setting for each of the 2 ethical hacking the methods section.
Module | Key activities | Optimized | Unoptimized |
Scanning | scanning tool to identify the number of ports, the port status, protocol, and operating system | Yes | Yes |
Discovery | Yes | Yes | |
Exploiting | Yes | Yes | |
Optimizing (optional) | Yes | No | |
Controlling | Yes | Yes | |
Reporting | Yes | Yes |
Both the optimized and the unoptimized ethical hacking were run 50 times (50 runs) each to account for the stochastic nature of ACO and to reduce the uncertainty owing to the simulation environment. The information regarding execution time, the number of exploits investigated, and the number of successful exploits used to construct the attack path was recorded for each run.
Table 5 presents the results of 50 runs of comparison of unoptimized and optimized ethical hacking methods, where the average time used to perform the penetration test, the success rate of all penetration tests, and the highest and average rates of exploits with regard to all exploits were used as comparison metrics. The highest numbers of exploits were 11 and 20, the average numbers of launched exploits were 8 and 14, the numbers of successful penetration tests were 32 and 42, the numbers the highest number of successful exploits were 9 and 18, and the average numbers of successful exploits were 5 and 11 for the unoptimized and optimized ethical hacking methods, respectively.
Comparison of the results of optimized and unoptimized ethical hacking after 50 runs.
Metrics | Unoptimized | Optimized |
Average used time (in seconds) | 178 | 160 |
Success rate of all penetration tests (%) | 64 | 98 |
Highest success rate of exploit or exploits (%) | 88.9 | 100 |
Average success rate of exploit or exploits (%) | 50.3 | 73.5 |
Figure 3 depicts in a box plot (each box composed by quartiles 1-3) the total number of launched exploits ( Figure 3 A) and successful exploits ( Figure 3 B) for both optimized and unoptimized ethical hacking methods with the average (indicated by X), median (indicated by straight line across the box), and SD (indicated by whiskers, which might go outside of the box plot or overlap with it). Figure 3 C depicts the box plots of the rate of successful exploits with respect to the total number of exploits, and Figure 3 D shows the average execution time for both optimized and unoptimized ethical hacking methods.
Results of the computational experiments for both unoptimized and optimized ethical hacking methods. (A) Total number of exploits; (B) Number of successful exploits; (C) Success rate results; (D) Average execution time.
To show an example of the results in a single run, the last run out of 50 runs for the unoptimized and optimized ethical hacking methods were compared for the penetration test for 192.168.1.44. The results of the unoptimized method show that the method ran for 177 seconds; out of 9 exploits, 7 were successful; and these exploits were related to improper input validation, cross-site request forgery, remote code execution (in Windows Remote Desktop Gateway), denial of service attacks, improper authentication, remote access backdoors, and the deserialization of untrusted data. In the case of the optimized method, the method ran for 153 seconds, and only 6 exploits were investigated, all of which were used to build a successful attack path.
The details of the exploits used for building a successful path are presented in Table 6 , which are related to remote code execution, cross-site request forgery, improper authentication, vulnerability in the Oracle Business Intelligence Publisher, an elevation of privilege vulnerability (in MediaTek), and remote access backdoor (in the web graphical user interface for the Linux Virtual Server).
Exploits used in the successful attack path found by optimized ethical hacking.
| Exploit | CVE number | Details |
0 | V7 | CVE-2020-0610 | /exploit/windows/browser/adobe_flash_otf_font |
1 | V8 | CVE-2012-0714 | /exploit/windows/browser/adobe_flash_regex_value |
2 | V9 | CVE-2012-5975 | /exploit/linux/http/piranha_passwd_exec |
3 | V17 | CVE-2021-23919 | /exploit/unix/webapp/openemr_upload_exec |
4 | V4 | CVE-2017-0503 | /exploit/windows/browser/adobe_flash_otf_font |
5 | V2 | CVE-2000-0248 | /exploit/linux/http/symantec_web_gateway_lfi |
a CVE: common vulnerabilities and exposures
In this study, we propose a novel methodological approach to ethical hacking in HISs. We conducted a comparable experiment by launching ethical hacking using both the optimized and unoptimized methods. In particular, we set up an HIS simulation environment by implementing the OpenEMR system and followed the NIST ethical hacking framework to perform ethical hacking. We launched 50 rounds of attacks using both the unoptimized and optimized methods. The results show that the optimized ethical hacking method outperforms the unoptimized method in terms of average time used, the average success rate of exploitation, the number of exploits launched, and the number of successful exploits. We were able to identify the successful attack paths and exploits that are related to remote code execution, cross-site request forgery, improper authentication, vulnerability in the Oracle Business Intelligence Publisher, an elevation of privilege vulnerability (in MediaTek), and remote access backdoor (in the web graphical user interface for the Linux Virtual Server). Theoretically, these findings contribute to HISs, ethical hacking methodology, and mainstream AI-based ethical hacking methods. Practically, the findings have great significance for the health care sector, specifically because OpenEMR is widely adopted by health care organizations.
Our work contributes to the HIS security domain by proposing an AI-based method for ethical hacking that helps identify vulnerabilities in HISs. In particular, we set up a simulation environment by implementing OpenEMR and performed systematic ethical hacking on this virtual platform. Existing cybersecurity research in health care places emphasis on the protection of medical devices [ 13 - 17 ] and medical data [ 18 ], such as data encryption mechanisms [ 13 ], combined or not with scrambling techniques [ 18 ], managing shared health data [ 14 ], securing digital patient profiles [ 14 ], and authentication protocols for wearable devices [ 15 ]. However, this focus disregards the HIS as a holistic system, which can potentially exhibit vulnerabilities in other functions. In addition, such studies typically do not examine how potential attackers can breach the security of HISs and access, for example, ECG records, that is, other records besides those that are strictly patient focused. In this study, we address this shortcoming by providing an approach that considers and approaches an HIS as a holistic system, whereby the novelty of the AI-driven ethical hacking approach is combined with the familiar NIST framework [ 38 ], which we adapted to perform ethical hacking systematically.
Our study further contributes to the ethical hacking methods section by proposing and validating a novel AI-based ethical hacking method that incorporates optimizing and controlling modules. Several ethical hacking methods exist today, including the NIST ethical hacking framework [ 38 ], PTES, and OWASP. However, they all have limitations. For example, Nettacker, a solution developed by OWASP, contains an optimizing module, but it is not as mature, not fully published, and lacks the exploiting and controlling module. The NIST ethical hacking framework and PTES do not have optimized and controlled modules.
Our study also addressed some of the shortcomings of mainstream AI-based ethical hacking methods. Mainstream methods typically adopt reinforcement learning. Reinforcement learning is an area of machine learning concerned with how intelligent agents ought to take action in an environment to maximize the notion of cumulative rewards. This approach differs from supervised and unsupervised learning because reinforcement learning aims to learn the algorithm to obtain the best results in highly complex and uncertain situations [ 48 ]. However, as previously explained, these methods have not yet been integrated into any ethical hacking methods, and reinforcement learning itself has considerable disadvantages when applied to ethical hacking, owing to its requirement for large data sets, the lack of reliability and predictability (which could cause severe problems for the whole system), low reproducibility, and sensitivity to environmental changes [ 20 ]. The use of ACO in our optimizing module addresses these shortcomings. Our implementation of the ACO algorithm as part of the optimization module shows that it can support the conduct of an efficient vulnerability analysis and detection and offers superior results.
Our proposed AI-based ethical hacking method has practical implications, as it addresses the weaknesses of ethical hacking tools such as Nettacker, APT2, and Autosploit [ 40 ], which are used by cybersecurity practitioners. For example, Nettacker lacks an exploit module. This means that a given user will have to select the exploit tools and payload on their own, which can be challenging for nonexperts in cybersecurity. APT2, the solution offered by the Massachusetts Institute of Technology, uses Nmap to scan information; however, it lacks an optimization module. This finding suggests that the accuracy and efficiency of ethical hacking risks are inferior. Similar to APT2, Autosploit [ 40 ] is a solution that combines Shodan, Censys, Zoomeye, and Metasploit, but it does not have an optimization module. The Metasploit can then run the exploit automatically. However, similar to APT2, Autosploit risks having less accuracy and efficacy because it cannot be optimized. Currently, it is unfeasible to test all possible system configurations.
Our proposed approach addresses these limitations. The combined effect of the 2 new modules is that our approach proposes an intelligent and maintainable ethical hacking solution. First, the incorporation of the optimization module supports the identification of the shortest path for the attack, which improves the efficiency of ethical hacking. Second, incorporating the control module provides a user interface and coordinates the other modules so that ethical hacking can be carried out by nonexperts, addressing the challenge of the shortage of security experts in the health care domain.
One limitation is that the simulation environment is set up in a virtual environment; although it is portable, it can potentially affect the performance of ethical hacking. As we are running the optimized and unoptimized ethical hacking methods in the same simulation environment, we would assume that this will have a limited impact on the comparable experimental results. Another limitation is that ethical hacking is set up in a network with one system or machine in the simulation environment. In real-world practice, it would be ideal to set up a network with multiple connected machines, so that ethical hacking can target multiple systems or machines.
From a cybersecurity defense perspective, future work should consider applying advanced AI techniques in HISs and explore security defense strategies to counteract cyberattacks. For example, future work could consider exploring other AI algorithms that have been used to resolve the TSP problem (eg, genetic algorithms) in the context of optimizing attack paths in ethical hacking. Future studies could also consider integrating advanced security defense strategies, such as Security Information and Event Management, Orchestration Automation and Response [ 49 ], and security operations centers. From an HIS perspective, future research could focus on building a more mature HIS that integrates diagnostic components such as arrhythmia detection and classification in ambulatory ECGs [ 50 ]. Finally, future research could expand the data set to include data from different medical devices, such as magnetocardiogram and magnetic resonance imaging.
In this study, we proposed a novel AI-based ethical hacking method, which we validated using an HIS simulation platform using OpenEMR as the focal HIS. We incorporated 2 new modules into the NIST ethical hacking framework, namely the optimization and control modules, and demonstrated the ethical hacking of the HIS simulation environment using optimized (AI-based) and unoptimized methods. The results show that the optimized ethical hacking method outperforms the unoptimized method in terms of average time used, the average success rate of exploitation, the number of exploits launched, and the number of successful exploits. We were able to identify the successful attack paths and exploits. Theoretically, the findings contribute to HIS literature, ethical hacking methodology and mainstream AI-based ethical hacking method as they address some key weaknesses of these research fields. Practically, these findings have great significance for the health care sector, as OpenEMR is widely adopted by health care organizations. It also addresses some of the key weaknesses of ethical testing tools used by practitioners.
CL was supported by the National Natural Science Foundation of China (grant 61803318) and the Scientific-Technological Collaboration Project (grant 2018LZXNYD-FP02).
We would like to thank Kun Ni for his efforts and participation in the creation of the software system.
ACO | ant colony optimization |
AI | artificial intelligence |
ECG | electrocardiogram |
HIS | health information system |
NHS | National Health Service |
NIST | National Institute of Standards and Technology |
Nmap | Network Mapper |
OpenEMR | open-source electronic medical record |
OWASP | Open Web Application Security Project |
PTES | Penetration Testing Execution Standard |
TSP | traveling salesman problem |
WHO | World Health Organization |
Authors' Contributions: YH is the first author. YH and CL contributed to the conception and design of the study. YH and CL contributed to data acquisition. YH, EZ, IY, and CL contributed to data modeling and analysis. YH contributed to the creation of the software system used in the study. YH drafted the manuscript. YH, CL, EZ, and IY have substantively revised it. All the authors contributed to the final work and approved the final version of the manuscript.
Conflicts of Interest: None declared.
IMAGES
COMMENTS
The goal of this chapter is to provide a conceptual analysis of ethical hacking, comprising history, common usage and the attempt to provide a systematic classification that is both compatible with common usage and normatively adequate. Subsequently, the article...
Ethical hacking, often termed as penetration testing or white-hat hacking, plays a critical role in identifying and mitigating security vulnerabilities within information systems.
A Survey on Ethical Hacking: Issues and Challenges. Jean-Paul A. Yaacoub, Hassan N. Noura, Ola Salman, Ali Chehab. View a PDF of the paper titled A Survey on Ethical Hacking: Issues and Challenges, by Jean-Paul A. Yaacoub and 3 other authors. Security attacks are growing in an exponential manner and their impact on existing systems is seriously ...
II. CONCLUSION This literature review provides a comprehensive synthesis of existing research on ethical hacking and its role in cybersecurity. By analyzing historical developments, methodologies, ethical considerations, contributions to cybersecurity, tools and technologies, and certifications and training programs, this review offers valuable insights into the multifaceted nature of ethical ...
As networks are expanding day by day, the need for security is attaining more attention. Hackers have always been renowned as a severe security threat. Ethical hacking is an important form of hacking. It is a type of hacking that doesn't hurt any individual, association, or gathering. It is done with a positive intent to find out the security loop-holes in the current infrastructure of some ...
In recent years the power and reach of prominent hacker groups such as Anonymous and LulzSec has been clearly demonstrated. However, in a world where hackers are able to wield significant online power, can they do so ethically as legitimate agents? To answer this question this paper will develop an ethical framework based on the premise that hackers have exhibited instances where they have ...
Ethical and Unethical Hacking. David-Olivier Jaquet-Chiffelle and Michele Loi. Abstract The goal of this chapter is to provide a conceptual analysis of ethical. hacking, comprising history, common ...
The article identifies a tension between common usage and a normatively adequate nomenclature and suggests a pragmatic best-practice approach for characterising ethical hacking, which reaches beyond business-friendly values and helps in the taking of decisions that are respectful of the hackers' individual ethics in morally debatable, grey zones. The goal of this chapter is to provide a ...
How will governments and courts manoeuvre within the boundaries of protected civil liberties in this new era of hacktivism? This monograph discusses moral and legal issues of ethical hacking and reviews analytics and trends.
Ethical hacking has been prone to lots of different issues that surround this domain, especially with ethical hackers lacking skills, experience and knowledge for a start.
Literature reviews of subareas within ethical hacking are also treated, such as a review of vulnerability assessments of cloud devices. The article's structure is inspired by [4], which detects research communities in cyber security (a broader perspective).
In the literature review, we searched for the three topics of Ethical Hacking, Cyber / Cybersecurity,and Risk Managementto gain knowledge from available literature and to find potential research gaps.
One strategy to reduce security vulnerabilities is ethical hacking. However, while ethical hacking can bring many advantages, it also comes with many challenges. This paper introduces a comprehensive study of the possibilities and limitations of ethical hacking in Spain, both empirical and normative.
The findings contribute to the HIS literature, ethical hacking methodology, and mainstream artificial intelligence-based ethical hacking methods because they address some key weaknesses of these research fields. These findings also have great significance for the health care sector, as OpenEMR is widely adopted by health care organizations.
The research contributes to the field of computer science because of the purposeful framework this paper displays-the paper focuses on the branch of Ethical hacking in the cybersecurity domain. It performs an easy to learn a framework that new or existing students can use to learn hardware hacking and the potential routes that come with it.
Hacking means reading email's of someone, stealing passwords, stealing credit card numbers etc. An ethical hacker is one who can help the people who are suffered by this hackings.
Inethical hacking can be defined as hacking that does not abide by any ethical value. Inethical hacking does not imply unethical behaviour, but removes ethical barriers and in doing so increases the risk of actual unethical behaviour. Greed is not an ethi-cal value or a moral principle.
The review of the literature concerning best practices appears to indicate that ethical hacking preparation demands a hands-on approach. Logan and Clarkson (2005) argue that receiving training in ethical hacking should be conducted with a "hands-on" approach.
1. Introduction. Ethical phishing is the technique of imitating the purpose and. behavior of malevolent attackers to unc over flaws and exploits in. computing and communication. The phrase ...
An ethical hack's results is a exhaustive description of the findings as well as a proof that a hacker with a definite amount of time and skills is or isn't able to successfully attack a system or get access to certain information. Ethical hacking can be categorized as a security consideration, a kind of training, a test for the security of ...
Ethical hacking is an identical activity which aims to find and rectify the weakness and vulnerabilities in a system. Ethical hacking describes the process of hacking a network in an ethical way, therefore with good intentions. This paper describes what is ethical hacking, what are the types of ethical hacking, impact of Hacking on Businesses ...
The proposed research emphasizes ethical hacking tactics. This research also examines the impact of ethical hacking on business, education, health, society, the workplace, technology, sensitive ...