How to Become a White Hat Hacker

What is a white hat hacker?

A white hat hacker is an ethical information security developer or engineer who uses their skills on behalf of organizations to test security configurations.

Ethical hacking began in the late 1960s, as corporations and government agencies started testing emerging telecommunications technologies and computers for security vulnerabilities. However, nefarious hackers emerged using the same skill sets to illegally seek information for personal gain.

Many businesses choose to work with managed service providers to outsource this side of IT and find ways to secure devices from hackers with less noble intentions.

What’s the difference between a white hat hacker and a black hat hacker?

While a white hat hacker reinforces security and plays by the rules, a black hat hacker is essentially a cybercriminal. Black hats operate with malicious intent to break laws, steal information and money, blackmail people, or take down corporations. Phishing schemes, malware, viruses and other cyberattacks are all attempts to gain access to a network system; the results can be devastating. Successful attacks can accomplish anything from slowing down a computer to ceasing a company’s operations, such as when hackers shut down the Colonial Pipeline in 2021.

Background and education requirements

White hat hacking involves significant problem-solving and communication skills. It also requires a balance of intelligence and common sense, strong technical and organizational skills, impeccable judgment, and the ability to remain cool under pressure.

At the same time, a white hat hacker must think like a black hat hacker and understand their devious goals and behaviors. In fact, some top-rated white hat hackers are former black hat hackers who got caught; they then, for various reasons, decided to leave the criminal life behind and put their skills to work positively (and legally).

There is no standard education criteria for a white hat hacker — every organization can impose its own requirements; however, a bachelor’s or master’s degree in information security, computer science or mathematics provides a strong foundation.

For those who aren’t college-bound, a military background, especially in intelligence, can create the foundation for a great resume for a white hat hacker. Military service is also a plus for employers who prefer to hire employees who already have a security clearance.

Pertinent certifications

Many white hat hacking and security-related IT certifications can help a candidate get a foot in the door — even without copious amounts of hands-on experience.

Certified Ethical Hacker

Achieving the Certified Ethical Hacker (CEH) certification from the EC-Council is one recommended starting point. The CEH is a vendor-neutral credential, and CEH-certified professionals are in high demand. According to PayScale, the median salary of an ethical hacker is around $86,000, and the top range can reach over $150,000. On the consulting side, the EC-Council states that CEH professionals can expect to be paid $15,000 to $45,000 per contract or short-term assignment.

The intermediate-level CEH credential focuses on the following:

• System hacking
• Enumeration
• Social engineering
• SQL injection
• Trojans
• Worms
• Viruses
• Other forms of attack, including denial of service (DoS) attacks

Candidates must also demonstrate a thorough knowledge of cryptography, penetration testing, firewalls and honeypots.

The EC-Council requires candidates to have at least two years of information security experience and pay a $100 application fee. It recommends a five-day CEH training class, but self-study options are also available to help candidates pass the single required exam.

To do well in the course, students should have the following:

• Windows and Linux systems administration skills
• Familiarity with TCP/IP
• Working knowledge of virtualization platforms

As part of the certification process, candidates must agree to uphold the EC-Council’s code of ethics and never associate with unethical hackers or malicious activities. The organization stresses that becoming a certified white hat hacker involves staying on the legal side of hacking; it also entails never engaging in illicit or unethical hacking activities and always protecting the intellectual property of others.

GIAC certifications

Aspiring white hat hackers should also look at the SANS GIAC curriculum. Candidates who start with GIAC’s Cyber Defense certs, beginning with the GSEC, might find themselves better positioned to climb through an active, well-respected and deep security curriculum.

The GIAC Penetration Tester (GPEN) and the GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) are both noteworthy certs for aspiring white hat hackers.

Cybersecurity Certification Roadmap

Another set of ethical hacking certifications comes from Mile2. The Mile2 Cybersecurity Certification Roadmap series features Cyber Threat Analyst courses. These courses include the foundational Certified Vulnerability Assessor (CVA); the Certified Professional Ethical Hacker (CPEH), the Certified Penetration Testing Engineer (CPTE) and the advanced-level Certified Penetration Testing Consultant (CPTC) follow. Qualifying U.S. veterans can use their Chapter 31 benefits to earn cybersecurity certifications and training through Mile2.

Related certifications in forensics

Dabbling in computer forensics is always a good idea for information security professionals. Those interested in the investigative side of security should continue with the EC-Council’s certification lineup and then tackle the Computer Hacking Forensic Investigator (CHFI) credential.

The CHFI focuses on the forensics investigation process and utilizing the right tools and techniques to obtain computer forensic evidence and data. As part of the CHFI’s certification training, candidates also learn how to recover deleted files, crack passwords, investigate network traffic and use various forensic tools to gather information.

Other worthy forensics-related certs include the GIAC Certified Forensics Analyst (GCFA); also included are the High Tech Crime Network Certified Computer Forensic Technician and Certified Computer Crime Investigator credentials.

The physical side of penetration testing

Not all penetration testing methods are digital. A site’s or facility’s physical access controls are also critical to security; this means that full-fledged penetration testing must involve attempts to compromise or circumvent physical security and equipment.

Trained penetration testers may try to tailgate through an access gate or ask somebody to hold the door for them when seeking to bypass a badge reader or keypad entry control system; they may also use other forms of social engineering to get around physical security equipment, controls and barriers. Getting up close and personal with equipment is a necessary first step in attacking its security, physical security and related security controls; this means that policies and procedures are every bit as important as similar measures on the digital side of the security fence.

Most information security certifications — including the CISSP, CISM and Security+ — include some coverage of physical security in the standard bodies of knowledge they ask candidates to learn and understand as they prepare for testing.

For those specifically interested in physical security, the Physical Security Professional (PSP) credential from ASIS International is probably the créme de la créme of physical security certifications. It’s worth checking out for those who want to understand the full range of penetration testing methods, approaches and techniques — especially in the realm of physical security.

Ethical hacking work on the rise

Research by Mordor Intelligence predicts the penetration testing market will soar to over $12.7 billion by 2029 — a significant increase from $4.25 billion in 2024. With cyberattacks on the rise each year, the demand for skilled professionals in the security field continues to grow. In 2023, the Identity Theft Resource Center recorded 2,365 cyberattacks that affected more than 343 million people across the U.S. alone. The more companies invest in cybersecurity measures, the better equipped they will be to detect and thwart these threats.

Changing cybersecurity laws also play a role in increasing demand and improving sentiments around this line of work. In 2022, the Department of Justice introduced a revision to the Computer Fraud and Abuse Act (CFAA) and announced that security research conducted in good faith should not be penalized. This revision covers activities such as the testing, investigation or remediation of security vulnerabilities — provided they are conducted to enhance security without causing harm. This decision further legitimized ethical hacking practices.

As artificial intelligence has become intertwined in countless other fields, it’s also revolutionizing cybersecurity practices. Cybersecurity companies are integrating these technologies into their systems to streamline operations and enhance the accuracy of detecting and responding to threats. As the technology improves, companies will need the minds and expertise of skilled professionals to adapt and use these programs effectively.

Using your skills for good

Candidates with an interest in information security — along with the appropriate background and a certification or two to start with — should have few problems finding ethical hacking work right away. Over time, you’ll use continuing education and more certifications to steer your career exactly where you’d like it to go.

Shayna Waltower and Eduardo Vasconcellos contributed to this article.