The good side of hacking—and why we need more of it.

On this episode, we have Asi, Maki Villano, and Alfie Ordoña joining us to discuss the good side of hacking and why we need more of it.

Hacking isn’t always a bad thing. This episode dives into the world of ethical hacking, where professionals deliberately exploit systems to identify vulnerabilities before malicious actors can. We’ll discuss the skills required to succeed in this field, how ethical hackers work with organizations, and why understanding your system’s weaknesses is one of the best ways to protect it from real-world threats.

How does someone get into ethical hacking as a career? (Generalization)

To get into ethical hacking, one must first build a strong foundation in IT fundamentals like networking, operating systems, and programming. From there, you can specialize in areas such as web application security, mobile security, or network defense. Pursuing industry certifications like the Certified Ethical Hacker (CEH) or Offensive Security Certified Professional (OSCP) is a great way to formalize your skills. Engaging in bug bounty programs on platforms like HackerOne or Bugcrowd also provides valuable real-world experience and a way to build a professional reputation.

What makes ethical hacking different from penetration testing—or are they the same? (Generalization)

While often used interchangeably, there's a subtle difference. Ethical hacking is a broad term for using hacking skills to find vulnerabilities, often in a continuous and general way. Penetration testing, or "pen testing," is a specific, formal, and time-bound type of ethical hacking. A pen test is typically a structured engagement with a defined scope, goals, and a formal report, conducted with the explicit permission of the organization. Think of it this way: all pen testers are ethical hackers, but not all ethical hacking is a formal pen test.

What’s the most serious vulnerability you’ve ever found? (Generalization)

While the specifics of a vulnerability are often confidential, the most serious ones typically involve an issue that could lead to complete system compromise or unauthorized data exfiltration. This could be a flaw that allows a remote attacker to gain administrative control of a server or a bug that exposes sensitive user data, like credit card numbers or personal health information. Such vulnerabilities are critical because they pose a direct threat to a company's integrity, customer trust, and financial stability.

How should companies respond when ethical hackers report bugs or issues? (Generalization)

When ethical hackers report issues, companies should respond with gratitude and professionalism. First, the company must have a clear and accessible vulnerability disclosure policy that outlines how a researcher can safely report findings without fear of legal action. The company should then promptly acknowledge the report, validate the findings, and work quickly to remediate the vulnerability. Providing credit to the ethical hacker and, in some cases, offering a financial reward or "bug bounty" helps foster a positive relationship with the security community.