What if one of the best ways to test a company's level of security was to think like a hacker? That's exactly what the pentester or ethical hacker. What does this job actually involve? Find out from one of them, Julien Valiente.
"A pentester is a hacker who turns his passion into a profession": this is how Julien Valiente, President of the ethical hacking firm Cyberwings and ORSYS trainer, sums up this specialised cybersecurity profession. A pentester is a professional hacker specialising in penetration testing (pentests). Its mission? Identify vulnerabilities in IT systems, networks, applications and websites to help companies improve their security. The job requires solid technical skills and, increasingly in demand, methodological skills, combined with a certain mindset.
The pentester, a professional hacker
Did you say ethical hacker?
While the term 'hacker' has existed in the United States since the 1950s, it has long had a bad press in France. "In itself, hacking is neither good nor bad. A hacker is first and foremost a tinkerer. Some hackers have malicious intent. Others, like pentesters, have an 'ethic'", explains Julien Valiente. In France, the word "pentester" appeared around 2010 and refers to the practice of hacking as part of a professional activity.
What is his day-to-day life like?
"The pentester practices hacking for ethical purposes through penetration tests", Julien Valiente repeats. Their job is to identify weaknesses, flaws and defects in security. By putting himself in the shoes of an attacker, he identifies attack scenarios and the paths that hackers might take. The ultimate aim of his mission is to help companies put in place the appropriate protection measures.
In practical terms, the pentester's day-to-day activities are organised around three main tasks. The first is to carry out penetration tests to try and find flaws in the security systems. The second concerns thereport writing containing information summaries and data correlations. The pentester transcribes the weak points it detects in terms of security. Finally, they devote the rest of their time to carry out tests to improve your practice.
Salaried or freelance?
Some large companies recruit employed pentesters if their needs justify it. The pentesters can then systematically test new products developed by the company in-house.
As these skills are currently in high demand, salaries for pentesters generally do not fall below €40,000 gross per annum for beginners. More experienced profiles (8 to 10 years' career) earn salaries of around €70,000 to €85,000 gross per year.
In addition, many pentesters work on a freelance basis so that they can choose their assignments according to the technical interest and challenge they represent. The person responsible for defining the scope of the assignment is generally the CISONext comes the actual penetration testing, which is carried out by the IT department (when it wants to test the security of a new architecture) or the product manager (as part of a software launch, for example). Next comes the actual penetration testing.
Intrusion testing in practice: what methods, what skills?
The different types of pentest
The different types of pentest
Not all pentests are created under the same conditions. There are three main types:
- Le external pentestThe pentester attempts to enter the customer's information system from the Internet.
- Le internal pentestThis was achieved by giving the pentester internal access (access that could have been obtained by a hacker).
- Le product pentestwhich relates, for example, to an appliance, an electronic device or specific software.
There are also different types of methodology, depending on the amount of prior information available to the pentester. Pentesting can be divided into :
- "Black Box", no information,
- A "Grey Box" with information such as a login and password or a map of the information system,
- "White Box" with all the information.
Pentesting is a highly regulated activity, governed by law, international standards such as ISO, and standards such as MITRE ATT&CK or certifications (OWASP(for example), the mastery of which attests to know-how and probity.
A typical pentest
A pentest generally involves five main stages:
- Acknowledgement The pentester collects data on its target, generally using tools such as Sublist3r, Nmap, Nessus, OpenVAS, Burp Suite, Wireshark and Aircrack-ng.
- Vulnerability scanning The pentester identifies weak points in terms of security.
- Exploitation of vulnerabilities The pentester attempts to penetrate the system using vulnerabilities identified in the perimeter.
- Persistence The pentester tries to find mechanisms that will enable him to extend his control and remain in the system for the long term.
- Cleaning : the pentester tries to remove his traces to erase any mark of his passage.
The watchword for these different stages? Realism. These different stages simply refer to the way in which a cybercriminal proceeds.
Pentesting specialities and the main skills required
As a discipline, pentesting is organised into different specialities. Each speciality requires a certain number of technical skills. The different profiles of pentesters include :
- The specialists attacks on communication networkswith solid skills in networks, protocols and network architectures.
- The cryptography specialistswho have an excellent knowledge of algorithms, software engineering and mathematics.
- The specialists in web attacksThey are familiar with the main target frameworks and the strengths and weaknesses of the modules and computer languages used.
- The specialists in physical attacks on equipmentThey can pick locks, deactivate alarms and modify video surveillance systems.
- The people specialistsThey are experts in social engineering and are capable of compromising users.
The vulnerabilities most often sought by hackers concern injections code, requests and templates, and bypassing authentication methods. Please note: the pentester must know how to code (Python, C, Go, Ruby, LUA, assembler, Perl), as they may have to write their own programmes. They must also undergo continuous training to keep their skills up to date.
Profoundly freedom-loving, the pentester can be a bit of a loner, but this character trait is often offset by an ability to work as part of a team and a genuine desire to share their knowledge and experience.
Increased training needs
A training offer in pentesting that is structured
There is a shortage of talent in the cybersecurity sector: according to Cybersecurity Ventures, there will be 3.5 million unfilled jobs worldwide by 2023. So there is currently a very strong international demand for pentesters. In France, some computer engineering schools offer a section in their final year enabling students to aim for pentesting. There are also courses leading to certification. Anglo-Saxon certification Certified Ethical Hacker or CEH is the best known.
In a profession that relies heavily on hands-on experience, pentesters need to continually improve their skills. While they do a lot of their own training, they also learn a lot from their peers, through communities and training organisations. "Systems are becoming more complex and technologies are evolving. Pentesters need to specialise", notes Julien Valiente. As a result, the range of training courses available in the field of pentesting is currently in the process of being structured, particularly in the field of continuing education, which is becoming increasingly well-stocked.
A need for acculturation to pentesting
Training in pentesting is not only of interest to pentesters. Security obligations require companies to regularly check that their security is working properly. Pentesting is one way of meeting these obligations, in addition to security audits and vulnerability scans, which do not serve the same purpose.
Pentesting therefore also concerns a whole category of people who have responsibilities in the field of cybersecurity and need to have their systems assessed by pentesters. By training in pentesting, CISOs, CIOs and company directors, for example, seek to ensure that the pentesting service they are about to launch will be well managed. "They are also learning how to better deal with threats by discovering in concrete terms how attackers go about it," emphasises Julien Valiente. In short, they seek to better understand how hackers reason and proceed.
Pentesting: more than just a job, it's a state of mind
A "hacking spirit
"You don't become a pentester, you discover that you are one", Julien Valiente laughs. As pentesting stems from hacking, it is a practice before it is a profession. "It's a way of looking at things, which consists of taking an interest in how new tools and systems work and asking how they can be turned to better advantage, for unexpected uses that are more fun, more secure or even more respectful of the protection of freedoms and data". Pentesting is not a neutral discipline. In fact, there is talk of a "hacking spirit", in which ethics, morality and freedom play an important role.
Freedom, emulation, constant progress: the main attractions of the profession
"About a third of a hacker's time is spent writing reports. This part of the job can sometimes be off-putting, but there are plenty of other attractions," says Julien Valiente. Pentesters are generally very attached to the notion of freedom and enjoy working at their own pace, based on assignments and objectives. They are generally very active in various communities. Mutual support, conferences and competitions keep the competition going.
Still little-known, the job of pentester is essential for ensuring the security and integrity of today's IT systems. Faced with the exponential growth in cyber threats and the increasing challenges of data protection, companies and institutions are increasingly aware of the need to invest in this type of skill. Ongoing training is essential in this constantly evolving field. Professionals need to keep abreast of the latest attack and defence techniques, as well as the tools and regulations in force. Internationally recognised certifications, such as CEH, OSCP and CISSP, are proof of skills that facilitate the integration of pentesters into the job market and establish their credibility.
In addition, it is necessary to promote ethics and accountability within the profession, in order to guarantee legality and trust between pentesters and their customers. Training centres and certification bodies have a crucial role to play in this process.
