White hat (computer security)

A white hat (or a white-hat hacker, a whitehat) is an ethical security hacker. Under the owner's consent, white-hat hackers deliberately hack software or system with the aim of identifying any vulnerabilities or security issues it has, helping to reinforce it from black hat hackers.

The white hat is contrasted with the black hat, a malicious hacker; this definitional dichotomy comes from Western films, where heroic and antagonistic cowboys might traditionally wear a white and a black hat, respectively. There is a third kind of hacker known as a grey hat who hacks with good intentions but at times without permission or proper consent.

White-hat hackers may also work in teams called "sneakers", hacker clubs, red teams, or tiger teams.

History of term

The modern contrast between white hat and black hat derives from the convention in Western films in which heroic characters were associated with white hats and villains with black hats. By the mid-1960s, white hat was being used more generally in American English to mean a person perceived as one of the "good guys" or as being on the side of right.

The computing sense developed from this wider moral contrast. The Oxford English Dictionary records white hat in computing slang from 1990, defining it as a person who engages in computer hacking for benign or altruistic purposes, especially to test security systems and prevent illegal acts. The related expression white-hat hacker was in use by the late 1990s, and by the early 2000s was being used for security testers contracted to probe networks and systems for weaknesses.

Employment

Interviews of staff in the UK in 2011 suggest that ethical hackers working for companies have skills around social engineering, mobile tech, and social networking.

In professional employment, the work of white-hat hackers substantially overlaps with penetration testing and ethical security testing with the ethical hacker most closely covering the role of a penetration tester, simulating the attacks used by malicious hackers in order to understand how systems can be defended.

White-hat roles may be filled by in-house staff or by third-party specialists contracted to test an organisation's security. In this setting, the distinction from malicious hacking is not primarily technical method, but authorisation, scope and professional discipline: white hats use attacker-like techniques within agreed legal and ethical boundaries. The penetration testing or ethical security testing industry had become organised around professional organisations, recognised qualifications and structured development routes, while also stressing that practitioners must not exceed the boundaries agreed with the client.

Notable certifications include the United States National Security Agency offering certifications such as the CNSS 4011. Such a certification covers orderly, ethical hacking techniques and team management. When the agency recruited at DEF CON in 2020, it promised applicants that "If you have a few, shall we say, indiscretions in your past, don't be alarmed. You shouldn't automatically assume you won't be hired".

Tools

Main articles: Penetration_test § Tools, and List of security assessment tools

A wide variety of security assessment tools are available to assist with penetration testing, including free-of-charge, free software, and commercial software.

Legality

Belgium

Belgium legalized white hat hacking in February 2023.

China

In July 2021, the Chinese government moved from a system of voluntary reporting to one of legally mandating that all white hat hackers first report any vulnerabilities to the government before taking any further steps to address the vulnerability or make it known to the public. Commentators described the change as creating a "dual purpose" in which white hat activity also serves the country's intelligence agencies.

United Kingdom

Struan Robertson, legal director at Pinsent Masons LLP, and editor of OUT-LAW.com says "Broadly speaking, if the access to a system is authorized, the hacking is ethical and legal. If it isn't, there's an offense under the Computer Misuse Act. The unauthorized access offense covers everything from guessing the password to accessing someone's webmail account, to cracking the security of a bank. The maximum penalty for unauthorized access to a computer is two years in prison and a fine. There are higher penalties – up to 10 years in prison – when the hacker also modifies data". Unauthorized access even to expose vulnerabilities for the benefit of many is not legal, says Robertson. "There's no defense in our hacking laws that your behavior is for the greater good. Even if it's what you believe."

France

France has established legal frameworks supporting responsible vulnerability disclosure and cybersecurity research. Security researchers may report vulnerabilities through coordinated disclosure processes, although unauthorized access to computer systems remains subject to French cybercrime laws.

Netherlands

The Netherlands has supported responsible disclosure through government-backed coordinated vulnerability disclosure policies. The National Cyber Security Centre (NCSC) encourages researchers to report vulnerabilities to affected organizations and states that reports made according to responsible disclosure guidelines may avoid legal consequences.

Singapore

Singapore has established vulnerability disclosure programmes to encourage security researchers to report vulnerabilities in government systems. The Government Technology Agency (GovTech) operates a Vulnerability Disclosure Programme, while noting that researchers must still comply with applicable laws, including the Computer Misuse Act.

United States

In the United States, ethical hacking and security research remain subject to federal and state computer crime laws, including the Computer Fraud and Abuse Act (CFAA). However, the Department of Justice has stated that good-faith security research should generally not be an enforcement priority under the CFAA when conducted in a manner intended to improve security and avoid harm.

Notable people

• Jennifer Arcuri, an American technology entrepreneur who founded the white hat cybersecurity consultancy Hacker House in 2016.

• Jim Browning, the alias of a Northern Ireland white hat hacker, scam baiter, and journalist known for investigations into online scams, including work featured on BBC programmes such as Panorama and Scam Interceptors.

• Troy Hunt, an Australian security researcher and creator of Have I Been Pwned, a service that allows users to check whether their personal information has appeared in known data breaches.

• Dan Kaminsky, an American security researcher best known for discovering a critical DNS vulnerability in 2008 and for his contributions to internet security.

• Charlie Miller, an American white hat hacker and security researcher known for discovering vulnerabilities in Apple products and for demonstrating a remote attack against a 2014 Jeep Cherokee, alongside Chris Valasek, that allowed control of vehicle functions including acceleration, braking, and steering.

• Kevin Mitnick, an American security consultant and former hacker who became known for his work in social engineering before later working in cybersecurity and founding Mitnick Security Consulting.

• Katie Moussouris, an American cybersecurity entrepreneur and researcher known for her work on vulnerability disclosure and bug bounty programmes, including helping establish Microsoft's early bug bounty initiatives.

• Joanna Rutkowska, a Polish security researcher known for research into operating system security, virtualization security, and the "Blue Pill" virtualization-based rootkit concept.

• Peiter Zatko (also known as Mudge), an American security researcher and former member of L0pht Heavy Industries who later held senior security positions in the technology industry and worked on cybersecurity policy.

See also

• Bug bounty program
• IT risk
• Locksmith
• MalwareMustDie