97 Things Every Information Security Professional Should Know

Chapter 16. Four Things to Know About Cybersecurity

Chloé Messdaghi

Here are four things to keep in mind about cybersecurity.

Hackers Are Not Attackers

The first is that hackers and attackers are not interchangeable terms for the same thing, i.e., threat actors. They use similar skills but radically different objectives.

A hacker is an ethical security researcher who proactively probes and explores an organization’s vulnerabilities with the goal of identifying them for the organization before an attacker can exploit them for malicious purposes. Hackers may seek compensation through a vulnerability disclosure program (VDP) or a bug bounty program, or just want to alert an organization to vulnerabilities and then, having allowed time for remediation, and with permission, may publish their research findings.

In contrast, attackers probe an intended victim’s network and systems seeking vulnerabilities to exploit—either for monetary gain, or to extract valuable or sensitive data.

In short, hackers serve to protect and are allies. Attackers are anything but.

Vulnerability Disclosure Policies Strengthen Defenses

VDPs are an important tool in strengthening organizational cybersecurity. A disclosure policy is an agreement between an organization and independent security researchers (also known as hackers) that benefits both parties. VDPs invite security researchers to examine an organization’s ...