Ethics and Law in Security Testing

Ethical hacking is the practice of probing computers, networks, or applications for security weaknesses with the explicit, documented permission of the system owner, following an agreed scope, and reporting findings so they can be fixed rather than exploited. The word "hacking" evokes unauthorized intrusion in popular culture, but the defining feature of the ethical variant is authorization: a written engagement letter or contract that specifies which systems may be tested, which techniques are permitted, and what happens if something goes wrong. Without that authorization, the exact same technical actions constitute a crime in most jurisdictions, regardless of the tester's intentions or skill. This distinction between sanctioned and unsanctioned access is the single most important concept in the entire field, and every methodology, tool, and career path discussed in this module assumes it as a starting point.