The 7 Hats of Hacking

Why should you know the different types of hackers?

As a cybersecurity professional or manager, your job is to defend your organization against cyber threats. Every cyber threat can be traced back to a threat actor, a type of computer hacker motivated to try and compromise your organization. Depending on the type of hacker you are dealing with, their motivations and tactics to compromise your organization may differ. In fact, some of them may even be assets in helping your organization to improve its security operations and defend against more severe threats. You must understand the different hats of hackers and how they can affect your organization to ensure that you are maximizing your company's effectiveness.

The 7 Types of Hackers

White Hat Hacking

From a defensive perspective, the first and most important type of hacker is the white hat hacker. A white hat hacker is a cybersecurity professional that companies hire to perform hacking simulations on the organization. Through these services, the hacker helps the organization to improve its security by making them aware of vulnerabilities that can be exploited to compromise the organization. These services are called penetration testing and have become a critical part of a company's cybersecurity strategy. A good penetration test is the best way for a company to understand how well they are designed to defend against an actual cyber attack. Additionally, penetration tests are now essential to many compliance requirements, making it necessary for many businesses at least annually. The many differences between this type of hacking and others on this list are that white hat hacking is done strictly with the company's express permission for security testing purposes.

Black Hat Hacking

A black hat hacker is a stereotypical cybercriminal who hacks to gain unauthorized access to business assets and steal confidential information for financial gain. There are endless ways that these hackers will target a business, including:

• Phishing
• Malware
• DDOS Attacks
• Cyber Espionage
• Financial/Identity Fraud
• Web Based Attacks

Overall, your goal as a cybersecurity professional will be to prevent this type of hacker from being able to hack into your organization and negatively impact your business. In addition to your cybersecurity operations, your best way to defend against this type of hacker is to leverage other kinds of hackers, such as white hat hackers, to help you understand how they will try to attack you and what you can do to prevent that.

Gray Hat Hacking

This type of hacker is the middle ground between a white and black hat hacker. This type of hacker is usually very skilled but doesn't want to help companies, nor do they want to harm or steal information from businesses. This type of hacker's primary motivation is to have fun, enjoy the challenge of hacking and fulfill their curiosity of if they can hack into something. Grey Hat hackers typically don't do anything harmful to a business. They hack into things to see if they can, then move on to something else. To leverage this type of hacker to your advantage, it's good to implement bug bounty programs or other rewards for hackers who want to disclose issues they have found with your business without fearing legal action. This incentive will encourage gray hat hackers who may have hacked into your environment to share your company's weaknesses. You can reward them financially or give them a shout-out on your company's media outlets praising their skill and determination.

Green Hat Hacking

A green hat hacker is considered a newbie in the hacking world. As the name suggests, this person is "green" meaning very new and has little understanding of the security mechanisms and inner workings of the web. However, this group is usually highly motivated to learn and eager to advance their position/reputation as a hacker in the community. This motivation can manifest itself in positive or negative ways depending on the route they want to take.

A subset of green hat hackers are people known as script kiddies. These are new hackers and don't have much experience, but rather than trying to learn new hacking techniques. A script kiddie focuses on using pre-existing scripts to hack. In comparison, green hat hacker focuses more on learning how to hack themselves and design their tools.

Red Hat Hacking

A red hat hacker tries to operate ethically but does it based on their own point of view. You can think of them with a "Robin Hood of the cybersecurity field" mentality where they may do illegal things if they believe it meets an overall ethical goal. For example, if they know that a black hat hacker is hacking into people's bank accounts, a red hat hacker may try to hack the hacker's systems to stop them from stealing people's hard-earned money. They take it upon themselves to define the lines of good vs bad hacking.

Blue Hat Hacking

A blue hat hacker is hired to find vulnerabilities in unreleased products before they are released to the market. This is done through invite-only penetration tests where the hackers can thoroughly hack the application as part of its comprehensive testing and development process. Microsoft is one company that is well known for having invite-only BlueHat conferences. Typically, to get invited, the hacker must have a strong reputation. Companies should use blue hat hackers before releasing new products to limit the possibility of a hack during the critical launch week/month. One example of this is with the platform bugcrowd. This is a platform where companies can hire freelance hackers/security researchers to test their products. They allow companies to do private testing where rather than opening it to the public they invite a small, select group of hackers to test the product before release. This is an example of blue hat hacking.

Purple Hat Hacking

Last on this list is the purple hat hacker, who practices their hacking skills on their PCs. This can mean buying a PC or using an old one to hack another one they own to see how effective their techniques are. This type of hacker poses minimal risk to anyone besides themselves, and they want to improve their skills in a controlled environment. This practice is an excellent way for hackers to test themselves and improve their skills. One professional that made a career out of teaching people how to do things like this is an IT professional called Eli the computer guy. He creates youtube videos teaching people how to self-study IT, cybersecurity programming and how to build their own at home labs for gaining experience.

Conclusion

A hacker is a general term for someone with advanced knowledge of computer systems and how to manipulate them. There are several different types of hackers with different motivations and skill sets. As an organization, you should leverage white and blue hat hackers to ensure that your organization is prepared for attacks by black hat hackers. By using these experts as part of your strategy, you can significantly improve the effectiveness of your organization's cyber operations.