When Your White Hat Is Really a Black Hat

 Don't get confused between the two.....

A series of recent news headlines reveal cybersecurity experts, who were being paid to defend networks, battle malware and fight cybercrime, were actually black hat hackers. What happened and what can be done to address this growing trend? Is your enterprise prepared?

Are you a good guy or a bad guy? Are you for us or against us? Can we truly trust all the people working for my company (or hired contractors) to protect sensitive data?

These basic questions are again being asked all over the world regarding the recent actions of technology and cybersecurity professionals.

For example, take a look at these four representative stories that have happened since May 2015:

Enormous leak exposes Hacking Team as blackhat organization (In Italy) - 
“The security community is buzzing about the release of more than 400GB of corporate data from the Italian security firm Hacking Team, a revelation that’s being called the security industry’s version of the Edward Snowden leaks. Hacking Team has been previously accused of being willing to sell its services and software to anybody, even authoritarian regimes with active human rights investigations ongoing. ...”

23-year-old twins allegedly tried to rip off the State Department and sell a bunch of passport data -
“Muneeb and Sohaib Akhter are twin 23-year-old computer whizzes who live in Springfield, Virginia. Last week they were indicted by the Department of Justice on accusations of hacking into various computer systems, stealing credit-card funds, and hatching a plan to access US government computers and sell passport and visa data.
In total, the Akhter twins racked up 12 criminal charges. ...”

Cybersecurity intern accused in huge hacking bust –
“The guy accused of being one of the world's top Android phone hackers is a bright young student who's been honing his skills as an intern at the cybersecurity firm FireEye.
Recently, the U.S. Justice Department announced a massive international bust of Darkode, an online black market for hackers. Among those charged with crimes was Morgan Culbertson, a 20-year-old from Pittsburgh. He's accused of creating a nasty malware that infects Android phones, steals data and controls the device.
Culbertson is currently a sophomore at Carnegie Mellon University in Pittsburgh. He's a two-time intern at the cybersecurity software maker FireEye where he's been researching malware on Android smartphones, tearing apart viruses, and analyzing them. ...”

Man accused of hacking into college women's accounts, 'sextorting' –
“A U.S. Department of State employee was arrested at Hartsfield-Jackson Atlanta International Airport and is accused of hacking into college-age women’s accounts and stealing compromising photographs for blackmail. Federal investigators say he used government computers at the US Embassy in London to commit the crime. Investigators say Michael C. Ford is a US citizen who has worked as an embassy employee in London since 2009. ...”

Are You a Spy? – No, This is Not a Movie
While the world has become accustomed to both James Bond films for decades and new cyber thriller movies with double agents working for multiple organizations at once, the current reality with technology and cybersecurity professionals has become much more complex.

The common definition given to a “good guy” or ethical hacker is a “white hat” hacker. The “bad guys” are generally labeled as “black hat” hackers. Some like to think of themselves as “grey hat” hackers as well.

A further complication regarding definitions comes into play when you consider cybersecurity industry conferences like Black Hat USA 2015, which opened recently in Las Vegas. 

Front-page highlighted press coverage at the event offers helpful advice regarding the recent Chrysler hack, alarms over driver safety and a conference attendee report describing the cyber mess we are in.
The attendee survey proclaims that it is time rethink enterprise IT security and offers potential solutions to our global online security problems. These are very helpful tools and answers for enterprises being offered at the biggest hacker event in the world.

There are numerous websites and tip sheets to help you not become a victim yourself. I find it interesting that so many precautions must be taken, which just proves that the norm has become “hacking back” as one answer. My point is that our society has made it trendy and attractive to be a black hat hacker and get attention by hacking a growing list of connected things.

Lasting answers in the area of cyberethics are very difficult to find right now. The situation seems even more like the Wild, Wild West or like the situation in 1930s Chicago, than when I wrote this popular “Are You An Insider Threat” blog for CSO Magazine back in 2010. News events describing new data breaches and other cyber incidents are quickly overtaking established laws, company policies and other rules.

Those who try to stand up for traditional definitions of right and wrong in cyberspace, are often laughed at by the majority of the hacker community. We have largely moved to a new online world in which the primary motivator is whatever cause you support, and “hacking back” is becoming the norm for more and more people. What can I offer? It starts with your own situation and the people you are working with and relying on to protect and defend sensitive data. We must trust and verify, but what does that really mean?
Obviously this is a very complex topic. I wrote a series of LinkedIn advice articles on this topic to help some struggling friends and professional colleagues at the end of 2014:

Part 1) Are You For Us or Against Us?
Part 2) Changing Security Culture With a New Approach
Part 3) Are You Engaged In Building Trust & Fixing The Security Culture?

In closing, I now take the terms “white hat,” “black hat” or “grey hat” hackers with a level of suspicion. I know plenty of people who view themselves in one category, who are very likely in another category based upon a long list of factors.  

We need to remember President Ronald Reagan’s “Trust But Verify” quote, which pertains to everyone on our cybersecurity and technology teams.   

GovTech:      Dan Lohrmann is SCO at Securiity Mentors Inc.