Types and Profiles of Attackers and Defenders

The terms "Black Hat" and "White Hat" originated from old Western movies, where villains typically wore black hats and heroes wore white hats.

• Black Hat Represents hackers who use their skills for criminal acts.

• White Hat Represents hackers who use their skills to educate and defend against malicious activities.

Black Hat Hackers

Black hat hackers are criminals who break into computer networks with malicious intent. Many start as "Script Kiddies" using purchased tools before developing advanced skills.

Leading black hats are highly skilled, often possessing formal training in computer science or security.

Motivations:

• Financial Gain: Theft of funds, ransomware extortion.
• Revenge: Retaliation against employers or individuals.
• Havoc: Creating chaos for its own sake.
• Ideology: Targeting industries or people they disagree with.

Operations (The Business of Hacking)

Black hat hacking has evolved into a global business model. They operate like legitimate businesses, creating distribution networks for malware. Some are recruited via forums or criminal organizations to be trained for quick profit making.

• Service Model: They develop specialties, such as "Ransomware-as-a-Service" or phishing kits, which they sell or rent to other criminals.

• Enforcement Challenges: Because they operate across different geographies, jurisdictions, and political landscapes, they are extremely difficult for law enforcement to stop.

Subcategories of Black Hat Actors

A. Script Kiddies ("Skids")

Novice attackers with low technical skills who rely on tools and exploits created by others to accomplish goals.

• Danger Level: While individually less skilled, they are dangerous because of their sheer numbers and lack of a predictable core motivation, making them hard to profile.

• Motivation: Gaining experience, simply being used by organized criminal groups, or Trading exploits.

B. Hacktivists

Individuals or groups where hacking meets political or social agendas. These groups are a mix of script kiddies and skilled black hats united by a cause. They target Governments, corporations, or individuals that oppose their ideology.

• Anonymous, LulzSec, WikiLeaks.

C. Cyber Criminals

Individuals or teams strictly motivated by profit. Perform Credit card fraud, identity theft, and the resale of medical records or bank account information.

D. Cyber Terrorists / Cyber Warriors

Elite cyber forces, often employed by nation-states or powerful organizations with significant financial and ideological resources. Cyber Warfare due to the nation-state involvement.

• Targeting to Disrupt major websites or critical infrastructure (electrical grids, water resources, communications) of a country.

• Espionage: Spying on target governments to gain strategic intelligence advantages.

White Hat Hackers (Ethical Hackers)

Ethical Hackers are security professionals who use their skills to defend systems by identifying security flaws and recommending improvements.

Instead of exploiting and taking advantage of the vulnerabilities, they try to fix it before malicious actors can discover and exploit them.

• They use the exact same tools and techniques as black hat hackers. The Key Difference is that, they operate with permission and defined guidelines from system owners, making their actions legal.

• Depending on their specific role, they perform a series of tests to check the efficiency of a security system. These tests can be simple security scans, policy and procedure tests, or attacker simulation tests.

• Tests can be performed by internal employees or third-party contractors attempting to find gaps in security.

Roles and Teams in Cybersecurity

White Hat Hackers are security specialists dedicated to defense, education, and authorized security testing. Their operations are often divided into specific teams based on their role in the defensive ecosystem:

A. Pentesters (Red Team)

Associated with Offensive security professionals.

• Often third-party contractors specifically hired to simulate real-world full-scale cyber attacks against a system to find exploitable vulnerabilities.
• Test how effective the Blue Team is at detecting and stopping them.

B. Blue Hat Hackers (Blue Team)

These are for Defensive Security professionals.

• These can be Internal employees who are in-charge of various security systems and responsible for establishing security measures, monitoring systems, maintain internal network defenses.

• They Adjust defenses based on their own tests, feedback or audits from Red Team to protect the organization against all incoming threats and attacks.

C. Purple Team

Purple Team members possess skills in both offensive and defensive disciplines. These are the collaborative group that integrates the tactics of both Red and Blue teams to maximize the organization's overall defense capabilities.

Understanding the problem, translating it, and offering potential solutions is what purple teams do between groups.

• Red and Blue teams often fail to collaborate effectively due to ego, embarrassment.

• There is Disconnect between what the red team is testing and communicating to the blue team and how they might go about understanding and correcting the issues.

• e.g., Red Team findings are too technical for Blue Team to implement directly).

Example of Purple Team Utility:

• The Issue: A Red Team pentest reveals a buffer overflow vulnerability in a legacy application.

• The Conflict: The Blue Team cannot "patch" the system because the application is outdated and no patch exists.

• The Purple Team Solution: They translate the risk into a defensive strategy: "We cannot patch this, but we can place this application in a high-security network zone where the exploit cannot be leveraged for further access".

Gray Hat Hackers

Hackers who operate in the "gray" area between Black and White hats.

• They typically operate on their own, searching for network faults without explicit permission, but without malicious intent to destroy or steal.

• The Intention is to demonstrate to owners that defects exist in their security posture and systems.

• Unlike Black Hats, They do not exploit vulnerabilities for profit or sell them to others;

• Unlike White Hats, they may not have had permission to test in the first place.

Operations

• Bug Bounties: Gray hats often look for companies with active bug bounty programs. This legitimizes their work, allowing them to report findings for compensation ("win-win" for company and hacker).

• Responsible Disclosure: Once a vulnerability is found, they contact the organization to allow them to fix it before making the information public.