Ethical Hacking Pedagogy: An Analysis and Overview of Teaching Students to Hack

ABSTRACT An area that is being scrutinized as a more effective method of educating and preparing security professionals is that of ethical hacking. The purpose of this research is to examine a more proactive approach to adequately prepare future information security professionals. Future careers in security may require that professionals be equipped with the necessary skill sets to combat an ever-growing presence of unwanted activity throughout the Internet. Many argue that future information security professionals need to have the same skill sets as attackers in order to adequately recognize and defend networks from intrusion. This research defines ethical hacking and examines the pros and cons of ethical hacking pedagogy as a viable approach for teaching network security to future professionals. The analysis includes the concept of ethical hacking education with an emphasis on ethical and legal concerns associated with ethical hacking pedagogy. The research concludes with an overview of existing best practices in ethical hacking education highlighting a hands-on approach as well as the inclusion of soft skills needed to complement the technical hard skills for future information security professionals. Keywords: Ethical hacking, information security instruction, ethical hacking pedagogy INTRODUCTION The prominence of information technologies and increasing dependence on technological infrastructures continues to infiltrate all of society. It may be argued that some concern stems from the apparent lack of security inherent within information technologies and systems. Of particular importance is our growing reliance on the Internet and networking capabilities. The Internet has provided vast opportunities in a wide array of areas not possible in prior years. Today we are able to access massive amounts of information, and connect in unprecedented ways. Along with the positive capabilities provided by the Internet and networking, unpleasant aspects also infiltrate in unexpected ways. While various crimes have existed for many years, the Internet and information technology have brought computer crime into our homes and businesses in unimaginable ways. Criminals of today have a new platform for conducting activities, and many individuals are so bewildered at the subsequent onslaught from these endeavors that in many cases only reactive measures may be implemented. The purpose of this research is to analyze the use of an ethical hacking pedagogical approach to improve information security instruction. A hacking methodology appears to be a more offensive and proactive approach for information security instruction. This approach may be effective to better prepare future information security professionals to combat unethical hacker intrusions associated with the Internet and computer networks. Future information security professionals would be better equipped to combat intrusions if equipped with the knowledge and skill sets currently used by attackers. In order to equip those professionals, students must be prepared to fight the ever-growing challenges associated with effectively securing computer networks. This research defines ethical hacking pedagogy followed by an overview of this approach in information security instruction. The ethical and legal implications are addressed regarding teaching students how to hack. Finally, a review of best practices in the field are examined featuring components necessary to use ethical hacking as a viable approach for teaching network security to students. A qualitative study was conducted focusing on the research question underlining the analysis of an ethical hacking pedagogical approach to improve information security instruction. Information was acquired utilizing the Belk Library and Information Commons at Appalachian State University. Searches were conducted in the databases and journals at the university. The databases are organized by subject matter, and "computer information systems" provided the majority of the literature. …