All language subtitles for 010 Professionalism (OBJ 1.3)

Instructor: Most people know

that hacking is a federal crime.

Therefore, it's important for a penetration tester

to be aware of the laws that deal with hacking

because penetration testing is effectively hacking.

There are local, state, and federal laws

that you have to understand

before starting your career as a penetration tester.

Laws also vary from country to country,

so if you're working on a penetration test

for an international organization,

you also have to check the local laws

where you're conducting the attack from,

as well as those of the country

that the target organization is located within.

Remember, always consult your attorney

before you accept and attempt

a penetration testing assignment,

because if you do this wrong

and you don't have the right legal framework in place,

you could be arrested under local, state, federal,

or even another country's laws.

Plain and simple, talk to a lawyer

and do everything legally within the bounds of the law.

While penetration testing is hacking,

it is more importantly hacking with permission.

This is actually authorized

under the law in most jurisdictions.

Now, there are two main laws that affect penetration testers

under the law inside the United States.

Under United States Code Title 18, Chapter 47,

Section 1029 and 1030, you're gonna find these two laws.

Now for the PenTest+ exam,

you don't have to memorize these laws.

But as a penetration tester, it is incredibly important

to understand what these two laws are.

Now, the first law, known as Section 1029,

is gonna be focused on fraud

and relevant activity with access devices.

It covers any technical or non-technical means

of trying to bypass an authorization system.

So as a penetration tester,

you might be using a password-cracking tool

in order to test the password strength

of a company's password security policy.

Technically, under section 1029, you are breaking the law

because you're attempting to bypass

an authentication system.

Now, if you don't have permission to test these passwords,

you could be charged and sent to jail as a computer hacker.

Again, this is why it is vitally important

to have permission from the organization in writing

as part of your contract, rules of engagement,

and other planning and scoping documents.

Once the company invites you in and gives you permission,

then it's no longer considered breaking the law.

It now becomes penetration testing, not illegal hacking.

The second law is known as Section 1030,

which is focused on fraud

and related activity with computers.

This is loosely defined to include any device

connected to a network.

So if you own a smart television

and it has a network connection to access Netflix,

it is considered a computer for the purposes of this law.

The same holds true for wearable devices

like fitness trackers, smart watches,

and even health information devices.

Again, if we have permission in writing,

then we can attempt to penetrate these devices.

Otherwise, it's considered an illegal action.

Now, there is one really interesting part of Section 1030

that I think you need to be aware of.

This component has the language in the law

that speaks to the act of exceeding one's access rights.

Now, for example, let's say an employee

uses their authorized username and password

to do things that go beyond the scope of their job.

This is technically considered computer hacking

under this section of the law

and would be considered a criminal act.

So if a system administrator uses their authorized username

and password to read other people's email,

this is actually a violation of that law

and that person could go to jail.

Employees, even those with a valid username and password

issued to them from their company,

are not authorized to use it in whatever way they want to.

If they do, they could be considered an insider threat,

and technically, they are breaking the law

and are conducting computer hacking.

Now, with that behind us, let's resume our coverage

of the PenTest+ exam and talk about some legal concepts

that you need to be aware of.

Now, before you conduct a penetration test, as I said,

it is imperative that you receive written permission

from the target organization.

This is what prevents a penetration tester,

also known as an ethical hacker

or authorized hacker, from going to prison.

Ethical hackers and penetration testers

are separated from criminal unauthorized hackers

by one simple thing, and that is permission.

When we get this written permission

in our contract or our scope of work,

we call this our get outta jail free card,

because effectively, that's really what it is.

Let's pretend that you are contracted

to conduct a penetration test of Sony Pictures,

but shortly after, the FBI shows up at your front door

claiming that you hacked Sony Pictures.

That would be a pretty bad day, right?

Well, if you can provide them a copy

of your signed written permission,

usually found in your contract, your scope of work,

or rules of engagement,

you're not gonna be held liable for those actions.

However, if you hack Sony Pictures without their permission,

this is considered a computer crime under Section 1029

and 1030 under the US code,

and you could be heading off to prison.

Now, as many organizations have migrated to the cloud,

the need for gaining third party authorization

has also increased dramatically.

For example, let's pretend that I'm gonna hire you

to assess my company's file storage solutions.

During our planning and scoping discussions, you learn

that I have an internal network-attached storage server

in addition to a cloud-based solution.

Now, in our discussions, we have scoped the assessment

to include both the onsite file server solution

and our cloud-based one.

So we sign a contract, you head back to your office.

Now, can you legally begin your assessment

of our file storage solutions?

Well, no, you can't because I don't have the ability

to give you authorization to conduct a penetration test

on my cloud-based one because I don't own those servers.

If you began your assessment right now,

you would actually be hacking my cloud service provider,

and if you don't get permission from them

before you begin your penetration test, well guess what?

You could be found guilty of criminal hacking

and you could go to jail.

Now, it's not just my permission that you need,

but you also need to obtain the permission

of my cloud service provider as well.

But don't worry, because cloud providers all know

that penetration tests have to happen

for compliance and regulatory reasons.

To obtain their permission,

simply do an online search for the cloud provider's name

and the phrase "penetration testing permission."

You're gonna find quickly

that they have the proper online form for you to fill out

to let them know your scope, your timeline,

and the duration of the assessment.

This allows the cloud provider

to capture some of your details

and notate that there will be an ongoing penetration test

so that their own security teams are aware of that.

Remember, you must get permission

from the owners of the servers.

So if the target organization

is using cloud-based resources,

then you have to obtain permission

from both the target organization

and the cloud service provider.

During your penetration test, you may also find

a lot of confidential information

about your target organization.

It's gonna be your responsibility to safeguard

that information, and if you're able to access an area

of their network that you think you shouldn't be in,

it's also important that you notify the trusted agent

inside that organization immediately.

You also wanna be careful not to have

confidential information leak out onto the internet

because that would be considered an unauthorized disclosure

by accident, and then your company may be held liable.

Again, make sure your lawyer

has properly drawn up your contracts

to ensure that your liability is limited

in case of accidental disclosures to minimize your exposure

to fees and fines in this area.

Additionally, it's important

for you to protect the information you gather

about the vulnerabilities in that organization's network.

For example, you're gonna find

major vulnerabilities sometimes,

and if you find a major vulnerability

in a public-facing server,

you'll want to inform the trusted agent

in that organization immediately.

You should also keep that information

close hold within your team and the trusted agent

within that organization

to ensure that only privileged personnel,

such as the IT director and their staff,

are informed of this major vulnerability,

so it's less likely to be exploited

before it can be remediated.

To ensure confidentiality and professionalism

in your penetration testing team, each of your members

should have a background check conducted on them.

Now, being a penetration tester

is gonna put you into a trusted position,

so there's gonna be organizations that hire you

and they need to know that you are trustworthy.

They might ask for copies of your credentials,

your certifications, and your educational transcripts

to ensure you have the knowledge required

to perform the work of a penetration tester,

but they're also gonna conduct a background check on you

that includes criminal history, driving history,

and a credit check.

If you have a criminal record or a felony conviction,

this is gonna be a disqualifier for a lot of positions

with penetration testing organizations,

but not necessarily all of them.

Now, as your team conducts its penetration tests,

sometimes you're gonna discover that the target organization

may have already been breached by a real world threat actor.

If you find evidence of a real attack,

you should immediately stop what you're doing

and report it to a trusted agent

within the target organization.

Alternatively, if you make a mistake

and you scan the wrong IP range or network,

you also need to stop

and immediately notify your team leader

because scanning the wrong target

could lead to legal issues for your team.

Finally, let's talk about fees, fines, and criminal charges.

As a penetration tester, you are in a risky business

if you don't have all your paperwork

and processes in the proper order.

Remember, you always wanna get your get outta jail free card

up front and discuss your engagements

thoroughly with your clients before beginning.

During your planning,

you need to think through different scenarios as well,

especially if you're gonna be doing

physical penetration testing.

For example, if I hired you

to conduct a physical penetration test in my office

and the security guard catches you in the act,

what is gonna happen?

Are they gonna call the police?

Are they gonna try to tackle you to the ground?

If you're gonna be doing physical penetration testing,

I recommend you always have your way out planned in advance.

For example, if you get caught,

do you have the head of security on speed dial?

Do you have a letter signed by the CEO

stating that this was an authorized test

or something else entirely?

Whatever it is, you need to plan for it.

And as you plan and then scope the assessment,

you need to make sure the process is clearly understood

by all of those who need to be involved.

For example, if the statement of work states

to conduct physical penetration testing

of our exterior defenses using various means,

that is probably a bit too generic.

Instead, you might state something

like "conduct lock picking" or "fence jumping"

or whatever it's gonna be.

This makes it much clearer and if you get caught,

when you pull out that get outta jail free card,

that permission letter,

people are gonna understand why you're there.

Now, remember, the thing that separates us

from malicious actors is permission.

Get permission throughout the entire process

and especially before any major events,

such as a DDoS attack or a stress testing

or physical penetration test.

If you don't, you could face fines, fees,

or even criminal charges.

(machine buzzing)