The extra code may set up a shell from which the hacker can operate, but, typically, he will want to install a back-door for future network access and use his new host to look for more information and the possibility of more profitable exploits, before covering his tracks. Of course, real hackers in this position can easily do untold damage by crashing key networks by mistake, even if they only intend to look around. The real value of the course we evaluated comes from the fact that it is taught by real ethical hackers, not by professional teachers. The knowledge they impart should give network managers the information they will need to minimise the threat from external hackers. But, as the course makes clear, the external hacker is not the only, or even the biggest, threat to an organisation.
Most corporate fraud is carried out by employees, or with their assistance.
That said, the impact of a successful hack can be out of all proportion to the actual damage done. For example, by simply putting a reference to a porn site in a firm's Web page, a hacker can destroy public faith in that company's ability to carry out secure e-commerce. Companies need to strengthen their defences to control the risk of external intrusion. And employing people who know how hackers operate is one of the best ways to go about it. Assessment of perimeter defences by an ethical hacking team is a good way to identify vulnerabilities in corporate networks.