Advanced level · Module 2: Vulnerability Management and Authorised Testing · Lesson 1 of 4
Law, Ethics and Rules of Engagement
Know when security testing is legal and ethical — and when it is not.
In this lesson you will
- Explain why authorisation is required
- Write rules of engagement
Key concepts
authorisationcomputer misuse lawsrules of engagementresponsible disclosure
The lesson
Accessing or testing systems without permission can be a crime under computer misuse laws in many countries, even if no harm is intended.
Authorised testing has written permission from the system owner, a defined scope, agreed times, named contacts and rules on handling data found.
If you discover a weakness in someone else's system, report it through their official channel (responsible disclosure) without testing further.
Step by step
- Read the lab rules.
- Identify what makes testing authorised.
- Write rules of engagement for a scan.
- Discuss three ethical dilemmas.
Practice activity
Write rules of engagement for the lab scanning exercise.
Expected result: Complete rules of engagement with scope, times, contacts and data handling.
Check your understanding
-
What turns testing from an offence into authorised work?
Show answer
Written permission from the system owner with a defined scope.
-
What should you do if you notice a weakness in another organisation's website?
Show answer
Report it through their official channel and stop.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.