Are Ethical Hacking and Penetration Testing the same?

 Are Ethical Hacking and Penetration Testing the same?

Hacking was a term that originated in 1990s and is associated with the unauthorized use of computer and network resources. By definition, hacking is the practice of altering the features of a system, to accomplish a goal which is not in scope of the purpose of its creation.

Hacking is more commonly used in context of “Computer Hacking” where threat is posed to security of the computer and other resources. In addition, hacking has few other forms which are less known and talked about .e.g. brain hacking, phone hacking etc.

“Hacker” was a term used to denote a skilled programmer who had competency in machine code and operating systems. Such individuals were proficient in solving unsatisfactory problems and often interpreted competitors’ code to work as intelligence agents for small software companies.But currently, hacking has a more negative implication and so is the term hacker. Hacking which is done on request and involves a contract of terms and conditions allows authorized access to the target and hence referred to as ethical hacking.

Computer and network security come under the foray when the information about possible attacks is tried to be evaluated to determine the weaknesses and loopholes in the system. Poor web-configurations, old or loosely bind software, inactive or disabled security controls and weak or low-strength passwords are some examples of areas that make computer networks and systems vulnerable to attacks. Ethical hacking involves identification of all or any such possible areas based on the suggested terms in the contract and the level of access given.

Eric Raymond has a better definition to hacking in his compilation ‘The New Hacker’s Dictionary’ as: A “good hack” is a clever solution to a programming solution and “hacking” is the act of doing it.

 Ethical hacking helps the organization better protect its system and information and is seen as part of an organization’s overall security efforts.

Hackers could aim to steal company’s valuable information and also render harm the intellectual property and other sensitive information. Companies may also run into the trouble of facing potential lawsuits if hackers steal customer information by getting into their systems. Ethical hacking is a way to check such thefts and make information less vulnerable to outside malicious hackers. Most hackers are technology buffs who are updated with know-how of computer technology and keep learning the different aspects of a computer, from programming and code view point to hack any particular system. They consider hacking as an art and a real-life application of their expert level problem solving skills. Such hackers take opportunity in assisting corporate with their abilities and help find flaws in security system of the computer and do not intend to harm others. Innumerable hackers attack the computer systems security by means of viruses, worms, exploits etc. A virus is a piece of software or a command sequence that exploits a bug or vulnerability in the code. A virus executes in a manner that it copies itself into other programs and files on the computer. The unexpected and unintended behaviour that is observed in computer’s operating system or applications is termed as exploit in each case. Worms are the viruses that send copies over network connections. A non-replicating program or virus that is distributed by means of a CD or an email is called Trojan horse.

The terms ‘ethical hacking and ‘penetration testing’ are often used interchangeably when referring to the process of probing an organisation’s systems, but they’re actually slightly different. Knowing where they deviate is essential as they’re each a core component of cyber security. You don’t want to call for an ethical hacker when you want a penetration tester or vice versa, because you’ll end up with a service that doesn’t meet your requirements.

What is Ethical Hacking?

The goal of ethical hacking – like criminal hacking – is to find security vulnerabilities in an organisation’s systems. However, as the word ‘ethical’ suggests, the person conducting the attack must have the organisation’s approval before proceeding.

Why would an organisation ask someone to hack them? 

Simple: they understand that one of the best ways to identify the flaws that a cyber-criminal might exploit is to think like a cyber-criminal themselves.

Ethical hackers are often hired before a new system or major update goes live. They test the systems, looking for weaknesses that they can exploit and keeping notes of their findings.

Similarly, organisations can call on ethical hackers as part of a ‘bug bounty’ scheme. These offer financial rewards to people who provide evidence of an exploitable flaw in the organisation’s systems. Bug bounties aren’t simply a way of helping organisations identify weaknesses, though. They also incentivise recreational hackers to stay on the right side of the law.

Whether they’re being offered a bounty or not, many hackers will probe organisations’ systems in their spare time because they enjoy the challenge. But once they make a breakthrough, they might find it tempting to use their discovery for criminal gain – moving from ‘white-hat’ hacker to ‘black-hat’. Offering them a reward for sharing their findings means it’s not simply a case of money vs ethics. Ethical hacking is a broad, umbrella term that includes all hacking and cyber attack methodologies and techniques. These are longer-term assessments conducted by the ethical hacker with the necessary permissions to explore the IT infrastructure more widely. Ethical hacking helps unearth security vulnerabilities and flaws by intruding the system using a wide range of attack vectors and attack types.

The professionals conducting ethical hacking must be differentiated from black-hat hackers who have malicious intent. Ethical hackers, with their understanding of the system, will not just locate vulnerabilities, but also study and suggest security-related methodologies to implement. The professionals conducting ethical hacking must be differentiated from black-hat hackers who have malicious intent. Ethical hackers, with their understanding of the system, will not just locate vulnerabilities, but also study and suggest security-related methodologies to implement

A comprehensive term and penetration testing is one of its features.

An ethical hacker essentially needs to have a comprehensive knowledge of software programming as well as hardware. 

An ethical hacker essentially needs to be an expert on report writing.

It requires to be an expert professional in the subject, who has the obligatory certification of ethical hacking to be effective. 

A detailed paper works are required, including legal agreement etc. 

Ethical hacking involves lot of time and effort compared to Penetration testing.

As per the situation, it normally requires a whole range of accessibility all computer systems and its infrastructure.

Types of Ethical Hacking:

Web Application hacking: Web hacking is the process of exploiting software over HTTP by exploiting the software’s visual chrome browser, meddling with the URI, or colluding with HTTP aspects not stored in the URI.

System Hacking: Hacktivists gain access to personal computers over a network through system hacking. Password busting, privilege escalation, malicious software construction, and packet sniffing are the defensive measures that IT security experts can use to combat these threats.

Web Server Hacking: An application software database server generates web information in real-time. So attackers use Gluing, ping deluge, port scan, sniffing attacks, and social engineering techniques to grab credentials, passcodes, and company information from the web application.

Hacking Wireless networks: Because wireless networks use radio waves to transmit, a hacker can easily squirt the system from either a location nearby. To discover the Identifier and bodge a wireless network, often these assailants use network snorting.

Social Engineering: The art of manipulating the masses so that they divulge sensitive information is known as social engineering. Eugenics is used by criminals since it is generally easier to attack your organic hard time trusting than it is to figure out how to spoof your device.

Types Of Hacker - White hats, black hats and grey hats

Hackers are divided into three categories. 

-White-hat hackers (i.e. ethical hackers) help organisations strengthen their defences by disclosing their findings.

- Black-hat hackers, on the other hand, are purely in it for criminal gain. They’re usually motivated by money, but their attacks could also be political or vengeful (such as doxing someone – maliciously publishing their personal information).

-In between those categories, you have grey-hat hackers. These are people who sometimes hack organisations in good faith but also conduct malicious attacks.

If this makes you worry about whether you can trust an apparent white-hat hacker, fear not. It’s extremely unlikely that anyone would conduct a malicious attack against an organisation they’ve been hired to probe, because it would jeopardise their career.

Importance of Ethical Hacking?

In the dawn of international conflicts, terrorist organizations funding cybercriminals to breach security systems, either to compromise national security features or to extort huge amounts by injecting malware and denying access. Resulting in the steady rise of cybercrime. Organizations face the challenge of updating hack-preventing tactics, installing several technologies to protect the system before falling victim to the hacker.

New worms, malware, viruses, and ransom ware are primary benefit are multiplying every day and is creating a need for ethical hacking services to safeguard the networks of businesses, government agencies or defence. 

What is Penetration Testing?

Penetration testing is a specific type of ethical hacking, in which an organisation hires a certified professional to assess the strength of its cyber security defences. These are usually performed via on-site audits of the organisation in question. The penetration tester will be given access to a certain amount of privileged information and attempt to use it until they find some sensitive information.

Different types of penetration tests focus on specific aspects of an organisation’s logical perimeter. These include:

1. External network Testing

2. Internal network Testing

3. Social Engineering Testing

4. Physical Penetration Testing

5. Web application Testing

6. Wireless network Testing

Unlike ethical hacking, penetration tests are typically carried out at regular, set times – typically quarterly or any time the organisation makes major changes to their networks or applications.

Penetration Testing or pen-testing is the formal/official process of assessing the maturity and strength of the security systems in place. Regular penetration testing enables businesses to find emerging security threats and vulnerabilities, gain critical insights into the exploitability of security vulnerabilities, and assess the security risks facing them.

By mimicking real-life attack scenarios under secure conditions, web application pen-testing, and other types of pen-testing are helpful, not harmful processes. Pen-testing empowers businesses to get the first-mover advantage in terms of security. 

Conducted by trustworthy and certified security experts, pen-testing is a very planned process. It is done after obtaining all necessary permissions from the management/ business and without interrupting the regular flow of work.

A narrow term focuses on penetration testing only to secure the security system.

A tester essentially does need to have a comprehensive knowledge of everything rather required to have the knowledge of only the specific area for which he conducts pen testing.

A tester not necessarily required to be a good report writer.

Any tester with some inputs of penetration testing can perform pen test.

Paper work in less compared to Ethical hacking.

To perform this type of testing, less time required.

Normally, accessibility of whole computer systems and its infrastructure doesn’t require. 

Accessibility is required only for the part for which the tester performing pen testing.

Penetration testing is a coordinated assessment process, usually performed by a team generally contracted. The organization defines the scope of what is to be tested and reported. The test involves a variety of items, but for the simplicity of explanation, an individual or team under contract would approach a system, assess the entire system for vulnerabilities or weaknesses through a predefined methodological approach, many times, those vulnerabilities are exploited in a controlled manner to identify the risk to the organization. From this point, a pen-tester would prepare a comprehensive report that includes an executive summary, vulnerability classification documents describing the issues in the system tested along with exploitation records showing what threat those vulnerabilities, if exploited, pose to the organization. Paired with an understanding of the business value of the system, exploitation results can help establish a risk score or matrix. With the executive summary, vulnerability classification, and exploitation results, recommended remediation strategies can be documented and shared in detail with key organization stakeholders in the form of a pen-test report.

Let’s explore the six main types of penetration testing:

1. External Network Penetration Testing

This type of pen testing looks at your current wealth of publicly available information or your externally-facing assets. The assessment team tries to leverage vulnerabilities they found while screening your organization's public information, or attempts to gain access to data via external-facing assets, like company emails, cloud-based applications, and websites.

For instance, an external pen tester may try to remotely breach your firewall or try to use public and private data gathered from leaked data breaches, OSINT, internally developed tools, credit bureaus, etc. to crack a password. These are the attack surfaces that a malicious hacker may try to exploit.

2. Internal Network Penetration Testing

On the flip side, some pen testers will also look for internal vulnerabilities. Under this simulation, a pen tester assumes the role of a malicious “insider,” or an ill-intended employee with a certain level of legitimate access to the internal network. These scenarios role-play what could happen should a rogue employee, contractor, or cybercriminal masquerading as a staff member attempt a hack from the inside. Pen testers look at the impact of confidential information being unwillingly disclosed, altered, misused or destroyed. Then, they use that data to recommend better controls over employees, such as enhancements to system privileges of access, improper patch management, little or no segmentation, vulnerable applications, protocol abuse (LLMNR and NBT-NS). Penetration tests are valuable for a variety of reasons. The most common are security maturity and risk management. This is a proactive approach many organizations take to identify their own weaknesses before cybercriminals do. Most commonly, however, penetration tests are used for compliance auditing. One example, for instance, is: with a publicly-traded company that is subject to SEC filing, the quarterly and annual financials reported to the SEC must be accompanied by an independent security audit validating the integrity of that companies’ systems. That independent security audit is a penetration test report.

3. Social Engineering Testing

This type of penetration testing assesses how susceptible your staff is to exposing confidential information. Social engineering involves an attempt to gain the trust of an employee, usually by tricking them into sharing private data or performing an action that exposes data to a masked malicious actor. Phishing emails are a prime example of a social engineering ploy. A hacker may pose as a manager (using a very similar email address), and ask an employee to share a login or transfer money under urgency. White hat penetration testers may try to exploit your staff into sharing protected information to reveal the need for more in-depth employee security training and management.

4. Physical Penetration Testing

Not all attacks are digital in nature. Physical penetration testing simulates a physical breach of your security controls by an intruder. Assessors may pose as a delivery personnel to attempt to gain access into your building, or quite literally break into your office to provide proof of real-life vulnerabilities. This type of penetration testing looks far beyond just physical theft and also considers sneaky threat actors, like those who may plug a malware-injecting device like a USB Ninja Cable into a computer to tap into your network.

5. Wireless Penetration Testing

Some organizations are the victims of wireless security breaches. Anyone within the given vicinity of your wireless internet connection could “eavesdrop” on the wireless traffic flowing across your organization by exploiting a vulnerability in your network. Unfortunately, tools for wireless hacking are now available in full-blown suites that offer simple “point and click” usability— so that even novice hackers can access data. A wireless pen test helps to ensure your Wi-Fi and wireless devices/protocols are properly safeguarded.

6. Application Penetration Testing

This type of pen testing focuses on vulnerabilities within your applications: from their design and development to implementation and actual use. Assessors look for flaws in the apps’ security protocol, including missing patches or exploited holes in externally-facing web applications, applications that run on internal networks and the applications that run on end-user devices and remote systems.

The EC-Council Pen testing Track

As established above, penetration testing, commonly referred to as pen-testing, is a coordinated, contracted, well-defined process that employs a variety of elements from scope identification and agreement, vulnerability assessment and classification, exploitation, documentation, report writing, risk analysis and categorization, and communication. The baseline skills for each of the aforementioned items must be considered to develop these skills in an individual or a team. EC-Council has been in the business of building penetration testing capabilities for companies all over the globe for the last 15 years.

Many consulting firms consider their pen-testing practices as proprietary and offer independent third-party penetration testing as a service in a common consulting engagement. Companies who decide to build this capability in house employ pen-testing as a continuous process for IT/IS Security Management to reduce risk and maintain a superior position with their cyber security programs. Once capable teams are assembled, companies can reduce their reliance on third-party assessors and increase the frequency of internal testing and consequently their cyber security posture and maturity.

How does this categorization help you?

Whether you are considering building pen-testing capability for an individual or a team, the baseline practical knowledge requirements are the same. Individuals, or collectively as a team, the pen-test process will require a variety of knowledge, skills, and abilities. At EC-Council, we have found many companies are going through the process of trying to transition from having an IT team that supports the business and outsources nearly all elements of cyber security, or they some fundamental cyber practice and want to develop and mature their cyber security capabilities in-house. Some organizations are looking to develop the practice to provide cyber security consulting services;

some have mandated these skills be validated and developed as parts of their team, such is the case with the United States Department of Defence and all contractors that work with them. DoD provides the skills requirement guidance under the DoD Directive 8140 and the new CMMC review processes.

The two concepts have similarities and are often interchangeably used, sometimes even by security professionals. However, there is a clear difference between penetration testing and ethical hacking, howsoever thin this line of difference may be.

 

Let us delve into these differences.

1. Purpose

Pen-testing seeks to find security vulnerabilities and weaknesses in the targeted IT system. It is usually not conducted on the entire application or IT infrastructure. It seeks to tell the business how their security systems respond to real-time attacks and suggest measures to strengthen the same. Ethical hacking seeks to find as many vulnerabilities and security flaws as possible in the IT environment using wide-ranging techniques and attack vectors. It seeks to provide a holistic evaluation of cyber security. More remediation and risk mitigation assistance are provided by ethical hackers in comparison to pen-testers who submit a report with suggestions on the completion of the testing.

2. Scope

Given the budgetary and time constraints, penetration testing is often conducted on specific aspects/ parts of the IT system defined for testing, not the entire environment. The assessment provided by pen-testing is targeted and point-in-time. As a result, security flaws and weaknesses are identified only in the targeted systems at a given point in time.

Ethical hacking has a broader scope and assesses the IT environment holistically over longer periods of time. So, there is scope to find as many security flaws and vulnerabilities as possible in the environment. Penetration testing is a subset/ function of ethical hacking. The scope of Ethical Hacking extends up to all types of hacking methodologies employed to identify errors in the security system. Penetration Testing focuses on a singular target environment and works to find the gaps in its security system.

3. Permissions Required

Since web application pen-testing and other types of pen-testing are targeted, the testers require access and permissions only for those targeted systems/ areas they are testing. While in ethical hacking, the tester needs access and permissions to a whole range of systems and areas, based on the defined scope.

4. Range

Ethical hacking is an all-encompassing term, penetration testing being a component of it.

Penetration testing is a part of ethical hacking that prioritizes the area specified for testing.

5. Skills required

To perform ethical hacking, one usually needs to have mandatory certification of the skill and have a comprehensive knowledge of all hacking techniques. However, penetration testing can be performed by anyone who has prior experience in conducting such a test. However, it is essential to know case-specific hacking methodologies and identify which method applies to which environment.

6. Access

Ethical hacking calls for unrestricted access to a wide range of systems within the IT infrastructure. Penetration testing can be carried out with access to only the systems that need to be tested

Who Conducts It?

This is one of the main points of difference between penetration testing and ethical hacking.

Penetration testing can be conducted by someone with knowledge and expertise in the specific area of testing. Ethical hackers must have comprehensive knowledge of software, programming techniques, hardware, and the IT environment to be effective.

Knowledge of hacking and attack methodologies in the targeted areas is adequate for pen-testers while ethical hackers must have a broader knowledge of attack methodologies and attack vectors.

While detailed reporting is necessary for pen-testing, ethical hackers must be experts in report writing and be capable of producing in-depth reports with recommended solutions.

Ethical hackers must be certified. Even though it is recommended to have certification, it is not compulsory for pen-testers if they have enough experience.

It is believed that the best pen-testers have ethical hacking knowledge and certification as it better equips them to conduct effective tests and produce detailed reports and actionable insights.

Which one is more effective of the two?

At various times, ethical hacking and penetration tests will be the right solution for you, as both help you achieve essential cyber security objectives.

Ethical hacking gives you a thorough assessment of your security practices and, in the case of bug bounties, can help you spot weaknesses in systems that are already live.

Its approach to cyber security is far more diverse than penetration testing. Whereas penetration testing focuses primarily on system weaknesses, ethical hacking gives actors the freedom to use whatever attack methods they have at their disposal.

They can exploit system misconfigurations, send phishing emails, conduct brute-force password attacks, breach the physical perimeter or do anything else that they believe will give them access to sensitive information.

This is extremely helpful for identifying exactly how vulnerable your organisation is to cyber threats, because crooks are increasingly mixing up their techniques and conducting multi-layered, sophisticated attacks. Of course, it’s often simply not feasible to go to such lengths every time you want to test the security of your system.

Penetration testing enables you to perform focused tests on specific parts of your organisation. The results are extremely useful for identifying system flaws – the extent of which can often only be identified through testing – and highlighting the steps that need to be taken to address them.

The benefits of this are self-evident, which is why so many data protection laws and frameworks – such the GDPR (General Data Protection Regulation) and the PCI DSS (Payment Card Industry Data Security Standard) – mandate that penetration tests be conducted regularly.

Penetration testing is very closely related to ethical hacking, so these two terms are often used interchangeably. However there is a thin line of difference between these two terms. This chapter provides insights into some basic concepts and fundamental differences between penetration testing and ethical hacking. Since penetration techniques are used to protect from threats, the potential attackers are also swiftly becoming more and more sophisticated and inventing new weak points in the current applications. Hence, a particular sort of single penetration testing is not sufficient to protect your security of the tested systems.

As per the report, in some cases, a new security loophole is discovered and successful attack took place immediately after the penetration testing. However, it does not mean that the penetration testing is useless. It only means that, this is true that with thorough penetration testing, there is no guarantee that a successful attack will not take place, but definitely, the test will substantially reduce the possibility of a successful attack. The comparison of CEH to Pentest+ is misleading. In a nutshell, you would not compare a cake to flour, as it makes no sense to compare an entire dish to a single ingredient. Ethical hacking on its own is NOT pen-testing. Penetration testing focuses on the security of the specific area defined for testing. Ethical hacking is a comprehensive term and penetration testing is one of the functions of the 

Ethical hacker. In many organizations, ethical hackers are not even involved in penetration testing teams or processes. Across many government organizations, ethical hacking is used to build the foundations of Computer Network Exploitation (CNE) and Computer Network Attack (CNA) Team. While these teams are highly offensive and very specialized, they will never be part of a penetration test. Their tactical cyber skills are highly coveted and take years to develop. In other organizations, Ethical Hackers are used for a wide variety of job functions to augment networks and methods by which tools and protocols communicate. Some are technicians for Intrusion Prevention Teams, SOC II Incident Handlers, Threat Hunters, etc. Ethical hacking indeed has a part in pen-testing, but that is just a piece. Ethical hacking on its own has grown into a very exciting dynamic profession over the past 15 years and truly stands on its own.

Often, for any enterprise, both ethical hacking and penetration testing may prove to be the correct tool for their purpose since both the practices share the common aim of strengthening the cyber security mechanisms of a system. However, the difference is that with ethical hacking, the coverage is broader- it offers you a comprehensive analysis of all the security systems in place. It helps you track and take down any bugs in the system that can potentially compromise the system to cyberattacks. The approach to ethical hacking encompasses a more significant field than that of penetration testing. 

In Pentest, the priority is finding the weakness in a particular system- the scope of work is much more restricted than ethical hacking where the professionals have the liberty to use whatever method they think would get the job done the best. This liberty includes exploiting faults in configuration, phishing emails, brute-force password attacks, breaking into the physical perimeter, and doing everything else to gain them access to confidential data. Since black-hat hackers often use their random mixture of methods to break into a protected system, ethical hackers also must use layered techniques to conduct these tests.

But this comprehensive coverage of ethical hacking makes it an unfeasible solution to be used repeatedly in short intervals. An organization must go to great lengths to conduct ethical hacking, but it also needs to analyze the efficiency of its security systems continually. This is where Penetration testing gives you the upper hand. Since it is a supremely specified type of ethical hacking practice, it saves an organization from the extraordinary efforts it would have had to get ethical hacking implemented every time it wanted to verify its security techniques. Pentest's results help you detect flaws within a limited scope of the system and bring into light methodologies to get rid of them. The answer is obvious, then. The level of effectiveness is not objective. It depends on the immediate need of the organization and the context. When it comes to regular testing of a security system, the choice is Pentest. However, for a long-term comprehensive analysis of the security measures, ethical hacking is the better option.

Overall, Pen Testing can be argued to be a subset of ethical hacking.  Ethical hacking in its extreme can be a process to hack the system just like a hacker will do, but with full permission from the business and key stakeholders to do so.

Pen testing focus is on identifying risks.  An ethical hacking focus is not just on identifying risk but to show and demonstrate the exploitation.  A bug bounty program is an ethical hacking exercise. Not all businesses can set up systems where exploitation can be done and hence a Pen testing and getting visibility and an understanding of the exploitable risks without the exploits carried out is an effective way to get visibility and fix them

Ethical Hacking is NOT Penetration Testing!

As the IS/IA profession matures, the core functions of the Information Security professional mature as well. Many companies have dedicated teams to handle the various aspects of cyber security, from Network and Sys Admins to Audit teams, SOC teams, Threat analysts, Incident Response and Handling, etc. Due to the scope required to protect systems and their critical role in organizational success, many companies outsource certain elements of their cyber security programs to third-party service providers with the proper expertise.

Ethical hacking is a practice. The skills employed by an ethical hacker allow them to practice a continuous assessment cycle of an organization’s security posture by employing the same tools, methods, and techniques of a cybercriminal (malicious hacker). Ethical hackers often have deep knowledge of the organization and its vulnerabilities, as well as its vulnerability management approach. Understanding possible weaknesses, they then utilize the same methods and tools a malicious hacker would use to exploit the weaknesses. This process allows organizations to test systems, vulnerabilities, security measures, policies, etc. to help identify risk, setup countermeasures, deploy defensive resolutions to problems, etc. The very nature of hacking is to use a system in ways it was not intended to be used to produce an outcome not expected by design.

The Closure

Both ethical hacking and pen-testing have their place in cybersecurity and in identifying security threats and vulnerabilities. Understanding the difference between two and choosing the right kind of experts to conduct these is critical for the effective identification of security threats and vulnerabilities and building a strong security strategy. The terms "ethical hacking" and "penetration testing" are often thought to refer to the same thing. But they are two different activities, albeit with a very slight difference. Understandably, people use the two terms interchangeably, given that the two tasks are complementary and fall under the same category of "Offensive Security." But within the same type, there are several other disciplines like red teaming, software reverse engineering, social engineering, among many others. However, both of the software testing methods play very significant roles in securing the business-critical data and processes of any organization.

CHECK OUT THIS VIDEO FOR MORE INFO... 👇👇Are Ethical Hacking and Penetration Testing Same?

AND ALSO SUBSCRIBE THE CHANNEL FOR MORE TECHNICAL UPDATES... 👇👇

FAME WORLD EDUCATIONAL HUB