Ethics, Scope, and Legal Compliance
Ethics, scope, and legal compliance tests whether you can act professionally under authorization, stay inside the rules of engagement, protect data, and report findings responsibly. Expect questions on written permission, scope boundaries, privacy law, evidence handling, and disclosure.
Core rules
- Get written authorization before any scan, exploit, or social engineering test. The authorization should name targets, source addresses, time windows, excluded systems, emergency contacts, and permitted techniques.
- Scope is not only IP addresses. It includes domains, cloud accounts, wireless networks, subsidiaries, and internal ranges reachable through a pivot. A new subnet discovered through a session is out of scope unless explicitly included.
- Laws vary by jurisdiction: the U.S. CFAA, the U.K. Computer Misuse Act, GDPR, HIPAA, and PCI DSS all affect what you may collect and retain. Authorization is a contract, not a defense against every law.
- Minimize data. Do not exfiltrate real personal data, healthcare records, or payment data when a hash, filename, or screenshot proves the finding.
- Preserve evidence with timestamps, hashes, and chain of custody. Report critical findings promptly and follow the agreed disclosure process.
Worked example
Your scope is 10.10.10.0/24. Through a session you discover 172.16.5.0/24. Do not scan it. Document the discovery, stop the pivot, and ask the client whether the internal range is in scope. Reasoning: reachability is not authorization; the signed scope names only the first range. If the client expands scope in writing, record the approval, then proceed. If not, report the exposed route as a finding without testing it.
Traps
- Relying on verbal permission or an email from someone who cannot authorize the test.
- Assuming a client-owned subsidiary or cloud tenant is included because it is reachable.
- Testing during a blackout window or against excluded production systems.
- Downloading real user data to prove access.
- Leaving backdoors, accounts, or persistence after the engagement.
- Hiding a critical finding until the final report.