Professional Integrity and Ethics Questions

Situation / Task
A client asks me to run a pen test that could touch competitor systems through API integrations and explicitly requests I test a named competitor to compare security. My responsibility is to protect the client while staying within legal and ethical bounds.

Action — step-by-step

1. Clarify scope and intent

   • Ask which assets, domains, and IPs are in-scope vs out-of-scope.
   • Request technical diagrams showing integrations to determine likely reach.

2. Legal & contract checks

   • Review the Statement of Work, Master Services Agreement, and applicable laws (computer misuse statutes, export controls).
   • Confirm we have written authorization from the client for only their assets.

3. Explicit written consent before touching third parties

   • Refuse any action against a competitor unless we obtain signed, time-bound written consent from that competitor or a court/order authorizing testing.
   • If competitor consent is obtained, require a tri-party agreement that limits methods, times, and liability.

4. Avoid conflicts of interest & ethics

   • Disclose any relationships with the competitor.
   • Decline tasks that create clear ethical violations (e.g., covert testing without consent).

5. Mitigation alternatives for the client

   • Propose safe options: test only the integrating endpoints the client controls, use simulated requests, conduct code review, or recommend coordinated disclosure/bug-bounty to the competitor.
   • Offer red-team exercises within legal boundaries or a scoped black-box test of the client’s integration points.

6. Communicate and document

   • Provide a written scope addendum describing prohibited targets, approved tests, risk tolerance, and incident response contacts.
   • Escalate legal or executive sign-off if required.

Result / Rationale
This approach ensures legal compliance, preserves professional ethics, avoids unauthorized access, and protects both our organization and the client. It also provides practical alternatives so the client still gains meaningful security insight without risking litigation or reputational harm.

Overview — prerequisite legal & ethical checks

• Obtain signed POA / Letter of Authorization (LOA)

  • Must name tester(s), client org, dates, scope, allowed techniques (e.g., social engineering, phishing, DoS), safe‑words/kill‑switch, and contact/escalation chain.
  • Keep copies (signed PDF) and ensure LOA covers sub‑contractors and tool vendors.

• Scope verification

  • Confirm in‑scope assets by IP/CIDR, domains, application URLs, cloud tenants, and user roles.
  • Explicitly list excluded assets (e.g., business‑critical systems, medical devices) and time windows for testing.
  • Validate with asset owners and update scope change procedures.

• Third‑party & upstream dependencies

  • Identify services hosted by CSPs, CDNs, SaaS providers, or suppliers requiring third‑party consent.
  • Obtain written permission from those providers when required (some cloud providers forbid active scanning without authorization).
  • Check contract terms that may restrict testing.

• Data privacy & sensitive data handling

  • Avoid exfiltrating or storing production personal data unless expressly authorized; prefer sanitized/test data.
  • Follow data minimization, encryption in transit/at rest, secure evidence handling, and chain of custody for samples.
  • Be aware of regulator-specific rules (GDPR data subject rights, PCI DSS cardholder data handling, HIPAA PHI).

• Local laws & service‑provider rules

  • Confirm testing complies with local criminal statutes, export controls, and wiretap/eavesdropping laws.
  • Review terms of ISPs/cloud providers (some forbid port scanning, backend API fuzzing).
  • For cross‑border tests, verify international consent and data transfer restrictions.

• Operational & ethical safeguards

  • Establish fallback/stop criteria (unacceptable impact, production outages), notification plan, and incident response contacts.
  • Maintain non‑disclosure and breach reporting obligations.
  • Log activities for accountability and provide transparent reporting to stakeholders.

This checklist ensures tests are authorized, legally compliant, and ethically conducted while protecting clients, third parties, and testers.