Legal, Ethical and Compliance Considerations
Legal, Ethical and Compliance Considerations
This domain tests authorization, scope, law, data protection, and professional ethics. Many exam scenarios hinge on whether the tester had permission and what they did with unexpected data.
Core rules and concepts
- Written authorization: contract, statement of work, rules of engagement, scope, time window, permitted techniques, emergency contacts, and sign-off authority.
- Laws vary: the U.S. CFAA, the UK Computer Misuse Act, and EU/UK GDPR are common references; PCI DSS, HIPAA, and SOX add contractual or regulatory duties. A framework is not a law.
- Scope includes IP ranges, domains, applications, accounts, and third parties. Cloud and SaaS providers often require their own approval.
- Data minimization: collect only what proves the finding; encrypt, retain briefly, and delete per agreement. Do not access unrelated personal data.
- Disclosure: report privately to the client; public disclosure needs written approval and coordination.
- Ethics: integrity, confidentiality, competence, and avoidance of harm. Stop if safety, legality, or scope is unclear.
- Liability and insurance should be agreed before testing.
Worked example
During an in-scope test, the tester discovers an unpatched server on an adjacent subnet outside the approved ranges. They stop interacting with it, record how it was discovered, and notify the client contact the same day. They do not scan or exploit it, even though it looks vulnerable. If the client later adds it to scope in writing, testing can resume. The report notes the observation as an out-of-scope risk without technical detail that could enable misuse.
Traps that cost marks
- Relying on verbal permission or an email that does not define scope.
- Testing a third-party or cloud service without its approval.
- Keeping customer data after the engagement.
- Publicly disclosing a finding without client consent.
- Continuing after an emergency or scope ambiguity.
- Treating a compliance framework as legal authorization.