Workshop 04 · Cybersecurity Ethics

Know Where the Line Is

Authorization, scope, consent, and responsible disclosure: what separates a security professional from an attacker using the same tools.

What You’ll Practice

Skill without judgement is a liability. This track covers the professional obligations that come with the rest of the lab.

Authorization & Scope

Written permission defines which systems, which methods, and which window. Outside it, testing is an offence.

Responsible Disclosure

Reporting a flaw to the owner, allowing time to fix, and publishing only what helps defenders.

Law & Professional Duty

Computer misuse and data protection law, plus the codes of conduct that bind practitioners.

Lesson 1

Authorization Is What Makes It Legal

The techniques in this lab are the same ones criminals use. What separates a security professional from an attacker is authorization: written permission from the system’s owner, covering exactly what will be tested.

How it works

Saudi Arabia’s Anti-Cyber Crime Law (Royal Decree M/17, 2007) defines unauthorized access as the deliberate, unauthorized access to computers, websites, information systems, or networks. Intercepting data without legitimate authorization can bring up to one year in prison and a fine of up to SAR 500,000 (Article 3). Unlawful access to delete, leak, or alter data, or disrupting a service, can bring up to four years and SAR 3 million (Article 5).

How it is prevented

  • Test only systems you own or have written permission to test.
  • Keep the authorization document with you, and stop if anything falls outside it.
  • Practise on environments built for it, such as this lab or other CTF platforms.

Lesson 2 · ETH-01

Scope and Rules of Engagement

A penetration test is defined by its scope: which systems, which addresses, which techniques, which dates and hours, and who to contact. Anything not written down is out of scope, however convenient it looks.

How it works

Scope is read literally. A subdomain that points to a third-party host is that third party’s system, so the client cannot authorize testing it. A test outside the agreed time window is unauthorized even if the target is in scope. 

In scope:      www.example.edu, portal.example.edu
Window:        22:00–06:00, 1–3 November
Not in scope:  mail.example.edu, third-party hosting, social engineering
Contact:       [email protected]

How it is prevented

  • Agree the scope, time window, methods, and emergency contact in writing before starting.
  • When something is unclear, stop and ask the client, rather than interpreting the scope in your favour.
  • Record what you did and when, so every action can be matched to the agreement.

Lesson 3 · ETH-02

Responsible Disclosure

Sometimes you find a real vulnerability by accident. Responsible (coordinated) disclosure means telling the owner privately, giving them time to fix it, and only then discussing it publicly, while doing the minimum needed to understand the problem.

How it works

The guiding question at each step is: does this reduce harm to the people whose data is exposed, and does it give the owner a fair chance to fix it? Downloading records “as proof”, sharing the flaw publicly first, or asking for payment in exchange for silence all fail that test.

How it is prevented

  • Stop as soon as the problem is clear. Do not view, download, or keep other people’s data.
  • Report privately to the owner’s security contact, with enough detail to reproduce it.
  • Allow time to fix. Google Project Zero, for example, discloses 90 days after reporting unless a fix ships sooner.

What You Take Away

Ethics is the part of this course that stays relevant no matter which tools you end up using.

  • Get it in writing

    Verbal permission is not authorization. Scope, methods, and dates belong in a signed document.

  • Stop at proof

    Demonstrate a vulnerability with the minimum access needed. Do not extract data to prove a point.

  • Minimise harm

    Prefer the action that protects the people whose data is at risk, even when a louder option is available.

  • Accept accountability

    Professional codes of conduct bind you to honesty about what you did, what you found, and what you could not test.

Sources

  1. Kingdom of Saudi Arabia. (2007). Anti-Cyber Crime Law (Royal Decree No. M/17). Bureau of Experts at the Council of Ministers, official English translation (2009). https://www.mcit.gov.sa/sites/default/files/anti_cyber_crime_law_en_0.pdf
  2. GovInfoSecurity. (2019). Iowa drops trespassing charges against penetration testers. https://www.govinfosecurity.com/iowa-drops-trespassing-charges-against-penetration-testers-a-13676
  3. Google Project Zero. (n.d.). Vulnerability disclosure policy. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html
  4. Nextgov. (2018, April). Uber agrees to expanded data breach settlement with FTC. https://www.nextgov.com/cybersecurity/2018/04/uber-agrees-expanded-data-breach-settlement-ftc/147411/

Ready to put it into practice?

Try the Cybersecurity Ethics challenges: capture the flags, score points, and unlock the explanation for each one.

Start the Cybersecurity Ethics challenges All tracks