They are professional burglars with a written contract. Digital spies who send a detailed report of their findings. They are penetration testers, the ethical hackers paid by the world’s biggest companies to think like criminals and break their defenses.

The Rules of Engagement: Hacking with a Hall Pass

The single most important thing that separates a penetration tester, or “pen tester,” from a criminal hacker is not a tool or a skill. It’s a document. The “Rules of Engagement.” Before a single line of code is written, a detailed legal contract is drawn up that defines the entire operation. This document is a “hall pass” to hack, and it sets the boundaries. It specifies:

• The Scope: Which of the company’s systems are in-play? Are they allowed to attack the main web server, the internal employee network, the physical office building?
• The Methods: Are certain techniques, like disruptive Denial of Service (DDoS) attacks, off-limits?
• The Timeline: The test is only allowed to happen within a specific window of time.
  This contract is the ethical and legal firewall. It’s what makes the job a highly respected security profession instead of a felony.

Keep Reading