"I think like a Hacker" - Why I chose the job of pentester!

Working in the IT security industry is incredibly varied. For example, as an IT security analyst, you can analyse and monitor the components of the entire corporate network and thus protect the infrastructure from attackers. As a system developer, for example, it's about designing and programming anti-virus applications and other protection tools against hackers. As an IT security consultant, it is your job to protect valuable data of your company and its customers.  

I, on the other hand, have chosen a career as a pentester. In this article I explain what my daily routine looks like, what a pentester earns and what qualifications are necessary.

The training to become a pentester

Working as a penetration tester is not a traditional career choice, such as a teacher or bricklayer. Rather, in most cases, the pentester gets to this position via a career within the IT industry. There are courses that teach basic knowledge about pentesting. However, these are not fully-fledged training courses, but build on existing knowledge. A basic understanding of IT security must be present, as well as knowledge of computer science in general. In principle, it is therefore necessary to first complete a classic apprenticeship or degree in the field of IT.

I first studied to become an IT specialist with a specialisation in system integration and computer science B.Sc. in a dual course of study. After that, I worked for a few years in a company in the IT security sector. There I was entrusted with the maintenance and improvement of an application that was used for network security in remote monitoring. Due to the changes in the field of IT security and the growing number of cyber attacks, the company I work for expanded their service offering. This included optimising security in customer networks. In this context, we carried out penetration tests from then on, for which specialised personnel were needed. After further education and internal training, I switched to the pentester job. In the process, I acquired certifications such as Offensive Security Certified Professional (OSCP) or Offensive Security Web Expert (OSWE).

A career as a career changer is also possible. Many young hackers have taught themselves their skills, often at a young age. The skills of some of these young hackers are amazing and sometimes surpass those of trained IT security specialists. Therefore, this group of people is basically well prepared for work in IT security. However, anyone with a criminal record in the field of computer crime has a poor chance of getting a pentester job. In this career field, we emphasise being white-hat hackers. This means that we use our skills and knowledge exclusively for good purposes.

My everyday life in the pentester job

The tasks of a pentester are exciting and can hardly be compared to anything else in the field of IT. My central role is to find vulnerabilities in the networks and IT security of our customers. In fact, I carry out cyber attacks on their systems.

We always carry out penetration tests in person. There are providers of automatic tests, where programmes reel off a kind of checklist and thus seemingly test networks for security. As a human pentester, I am more effective than a programme. I not only act intuitively, but also according to the situation. That is why I chose the description "I think like a hacker" in the introduction. A real pentest requires a real person to simulate the cyber attacks. Thus, with my experience as well as the evaluation of the respective situation I find when penetrating foreign networks, I find every vulnerability. Of course, such cyber attacks only take place after prior consultation with our clients. In Germany and many other countries, the actions of a pentester are only legal if the organisation being tested is informed of them. Consent and knowledge are required because some of a pentester's methods of attack constitute criminal offences under the law. This is the case, for example, if I am successful in a penetration test, penetrate the client's network and obtain sensitive data or personal information.

The attack methods of a pentester have a lot in common with those of real hackers. There are no or hardly any restrictions on the attack methods of pentesters. This is important at the same time, because the pentester job is about me uncovering every weak spot, no matter how small, in our clients' networks. To achieve this goal, I have different investigation methods at my disposal. The security audit variants simulate the attack scenarios that also occur in real situations.

Methods I use in the context of a pentest

Black box audits are tests in which we have no knowledge of the client's passwords, network structures and other details. Black box audits therefore simulate cyber attacks as hackers carry them out every day. In this way, I test the general security of networks against external attacks. The pentester's attack methods in the context of black box auditing include DDoS attacks, for example. In such cyber attacks, I overload a network with a concentrated, high number of requests, for example via HTTP. This type of cyber attack in the context of a penetration test checks the general capabilities of a network to deal with threats from the Internet.

In a white box audit, on the other hand, we use information about the client's network for the simulated cyber attacks. We receive this from the client in advance. This includes passwords, access to accounts with administrator rights or access to the source code of applications. It is precisely during these tests that I often come across security gaps. The white box audit is often commissioned by clients with the aim of uncovering internal attacks. Former employees or even employees with bad intentions also have access to such information. But external attackers also get hold of some of this data time and again. For example, it often happens that hackers use an active account of an employee and steal data from there or introduce malware into the company network. The goal of the white box audit is to determine whether the IT security of an organisation can distinguish such actions from regular access by authorised employees.