Ten tips of Ethical hacking

Here are 10 tips for Ethical hacking which will surly help you alot

1. Get it in writing.
   You've heard it a thousand times, but believe it or not I've seen security professionals perform -- and security managers allow -- ethical hacking on critical business systems without putting anything in writing ahead of time. You've absolutely got to cover your assets and not only get a basic sign-off by all parties involved, but also consider and document who's responsible (or not) when something goes awry during the testing. Bad things can happen during ethical hacking -- servers can crash and data can get lost. Think about this from a business perspective. You'll make your lawyer and insurance underwriter proud!
2. You've got to have goals.
   Just like with any successful business venture, you've got to determine exactly what you want to get out of ethical hacking. What outcomes are you looking for? Is this to prove you need to migrate to a Novell or Unix platform? Are you trying to get more money to spend on security? Are you trying to comply with federal regulations or meet security standards? Also, ask yourself what information you're trying to protect and which systems need to be tested.
3. Don't try to test everything at once.
   This doesn't necessarily apply to small networks, but who really has a small network any more? Prioritize the systems that need to be tested, and test the most critical ones first. This is most likely Web, e-mail or database servers, and even perimeter devices such as routers and firewalls. Look for single points of failure and systems your business can do without. Many security professionals focus only on publicly accessible hosts. Remember that hacking can occur from inside the network, so don't forget about the insider threat and the systems that could be affected by it.
4. Don't forget to test the "unimportant" systems.
   OK, so this conflicts with lesson number three. Well, not exactly. You don't have to test all of your systems, but it does help to think through how attacks can occur and affect other, less important systems. Workstations that don't have confidential data on them, the telecommuter's home PC or that Web server that only provides basic e-mail access are often the systems that are used as stepping stones to attack other, more critical systems. Never rule out the rogue "little guy."
5. It sounds clichÉ, but thinking like the enemy really does help.
   On the heels of lesson number four comes the tried and true "know your enemy." It's old-fashioned, but true. If systems are tested using only the latest automated tools without thinking through all the other various ways manual hacks that can be carried out, the complete picture won't be seen. There's no way to test for every possible hack from every possible angle. The key is making sure the research has been done and hacker motives and methods are understood and made part of your ethical hacking program.
6. Use the right tools.
   This is something I'm reminded of every time I perform ethical hacking tests. I don't know what I'd do without the tools (both freeware and commercial) I've gathered over the years. It's just like any successful homebuilder will tell you; you've got to have the right tool for the task at hand. Otherwise, it will likely be an exercise in futility with bad results. As a security manager, make sure your team or the third-party ethical hackers you've hired have the right tools. Many are not simple to use and many are not inexpensive, but they sure are worth it.
7. It's all in the timing.
   Ever hear of someone pounding on a system with a million packets per minute to see if the TCP/IP stack is stable? This kind of testing might be OK, but as my mother always told me, there's a time and a place for everything. Make sure that the ethical hacking tests are not carried out during peak network or host usage. You don't want the network to run slow or have a system crash. There are a lot of security tools that can do just that if the system is unstable or overloaded with other requests at the time the testing is being carried out. Come up with a timeline. And put it in writing!
8. Don't think that no penetration means you're secure.
   A very common misconception is that if no penetration was possible that the systems must be secure. Nope! It could be that the right tools weren't used or the right systems weren't tested. It could also be that a vulnerability has not yet been discovered for the system you're testing. Ethical hacking is a snapshot in time of a few specific systems. There could be a rogue router (or user) presenting a security problem on the other side of the world that was overlooked or not part of the original scope. You just never saw it.
9. Keep up the good work.
   Lesson number eight is what makes number nine critical. I know you hear about testing your systems over and over again. It's true; things change. New threats and vulnerabilities crop up. Make sure your systems are being tested periodically for new issues and to catch vulnerabilities that were missed in the past. Repetition is key.
10. Focus on the important and urgent vulnerabilities
    I've seen a lot of security managers feel obligated to fix every vulnerability discovered during the ethical hacking process. It realistically can't be done. It's not reasonable or fair to put pressure on yourself or your team to secure everything. Take the route that time management experts recommend when prioritizing daily tasks: go for vulnerabilities that are both important (high impact if exploited) and urgent (high likelihood of being exploited). The other vulnerabilities can then be addressed as time, resources and money allows.

If you can incorporate into your ethical hacking efforts even just a few of these 10 lessons I've learned over the years, I know they'll make your job as a security manager a little easier; after all, every little bit counts.

Read more at: http://searchsecurity.techtarget.com/tip/Ethical-hacking-Ten-crucial-lessons