Ethical Hacking Foundations and Rules of Engagement

Week 1 · Week 1: Ethical Hacking Foundations and Rules of Engagement · CFAA — 18 U.S.C. § 1030 · Download .docx

Objectives

Define ethical hacking and distinguish it legally from unauthorized computer access under the CFAA
Identify the five phases of the ethical hacking methodology and their defensive mirrors
Classify the five major threat actor categories by motivation and skill level
Explain the CIA triad and map it to concrete defensive controls
Describe responsible disclosure and the purpose of rules of engagement

Key terms

Ethical hacking: Authorized, rule-bound security assessment using attacker techniques under written permission for defensive purposes.
CFAA: Computer Fraud and Abuse Act — the primary U.S. federal law criminalizing unauthorized computer access regardless of intent.
Rules of Engagement: The signed contract defining scope, timeline, permitted techniques, and escalation procedures for a penetration test.
CIA triad: Confidentiality (restrict access), Integrity (prevent unauthorized modification), Availability (ensure authorized access) — the organizing principle of information security.
Penetration test: A structured, authorized simulation of an attack against a target system to identify vulnerabilities before malicious actors can exploit them.
Hacktivist: A threat actor motivated by political, social, or ideological goals who uses hacking to advance a cause.
Nation-state actor: A government-sponsored threat actor conducting espionage, sabotage, or influence operations.
Zero-day: A vulnerability unknown to the vendor with no patch available — the most dangerous class of vulnerability.
Responsible disclosure: Reporting a discovered vulnerability to the vendor privately before any public announcement, giving them time to patch.
Pre-engagement: The planning phase finalizing scope, RoE, and legal agreements before any technical testing begins.
Bug bounty: A structured program where organizations reward researchers who responsibly disclose vulnerabilities.
NIST CSF: NIST Cybersecurity Framework — five core functions: Identify, Protect, Detect, Respond, Recover.

The concept

Ethical hacking is the authorized practice of assessing an organization's security posture using the same methods and mindset as malicious attackers — with one critical difference: written permission. That authorization transforms an act that would otherwise be criminal under the Computer Fraud and Abuse Act into a legitimate professional service.

The legal foundation matters from day one. The CFAA, 18 U.S.C. § 1030, criminalizes unauthorized access to computer systems. Intent does not matter under the CFAA — only authorization. Before any technical work begins, the penetration tester and the system owner must establish a signed Rules of Engagement document specifying exactly which systems may be tested, which techniques are permitted, the test window, and what happens if a critical vulnerability is found.

The five phases of ethical hacking mirror the attacker kill chain:

1. Reconnaissance — gathering intelligence about the target without interacting with its systems (passive) or by probing it directly (active).

2. Scanning — mapping open ports, services, and operating systems on identified hosts.

3. Exploitation — attempting to leverage discovered vulnerabilities to gain unauthorized access within the authorized scope.

4. Post-exploitation — demonstrating real-world impact by showing how far an attacker could move after initial compromise.

5. Reporting — delivering a confidential written report to the client with findings, severity ratings, and remediation guidance.

Every phase has a defensive mirror: threat intelligence, vulnerability scanning, incident response, forensics, and remediation planning.

Threat actors are classified by motivation. Script kiddies have low skill and use pre-built tools for notoriety. Hacktivists are ideologically driven. Organized crime focuses on financial gain through ransomware and fraud. Nation-state actors conduct government-sponsored espionage. Insider threats misuse authorized access — the hardest category to detect because they already have legitimate credentials.

The CIA triad organizes every security decision. Confidentiality controls restrict access to authorized parties. Integrity controls prevent unauthorized modification — checksums, digital signatures, and version control. Availability controls ensure authorized users can access systems when needed — redundancy, failover, and DDoS mitigation.

Responsible disclosure closes the loop: when a researcher finds a vulnerability, notifying the vendor privately before any public release gives them time to develop and distribute a patch, protecting users while still rewarding the researcher's work.

Standards: Maryland Blueprint Pillar 3 · EC-Council CEH v12 Domain 1 (Information Security and Ethical Hacking) · PGCC INT-2681 Outcomes 2, 3, 7, 8.

Worked examples

Example 1: [object Object]

Example 2: [object Object]

Common mistakes

Assuming verbal permission is sufficient. Only written, signed authorization is a legal defense under the CFAA.
Treating 'ethical hacking' as a synonym for 'safe hacking.' The techniques are identical to malicious attacks — the authorization is what changes the legal status.
Confusing pre-engagement with reconnaissance. Pre-engagement is the legal and contractual phase; reconnaissance is the first technical phase that begins only after the RoE is signed.
Misclassifying threat actors. Nation-state actors and organized crime are distinct — their goals, targets, and tools differ significantly.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. Which document transforms a penetration test from criminal activity into authorized security assessment?

2. The Integrity property of the CIA triad is most directly protected by:

3. Which threat actor category is the most difficult to detect because they already have legitimate access?

4. Responsible disclosure requires the researcher to:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top