Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.
Authorization is the line between learning and committing a crime. Cross it properly, then start practising.
By the end of this lesson
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.
Everything you have learned so far is neutral. What makes security work legitimate is authorisation: permission from the person who owns the system, for a defined scope, for a defined period.
Without it, curiosity becomes a criminal offence. With it, you can learn aggressively and safely.
A professional engagement starts with a written agreement that defines:
Scope is a boundary, not a suggestion. Finding a vulnerable system outside scope does not authorise you to test it; it authorises you to report it and ask.
Laws differ by country, so this is orientation rather than legal advice.
In the UK, the Computer Misuse Act 1990 criminalises unauthorised access to computer material, unauthorised access with intent to commit further offences, and unauthorised acts that impair operation. "Unauthorised" is the key word. A port scan, a login attempt or a web request can all qualify if permission is absent.
The GDPR and the UK GDPR regulate personal data: lawful basis, minimisation, retention and breach notification. Security testing that touches personal data needs a plan for handling it.
In the EU, the NIS2 directive and national implementations add obligations for essential and important entities. In the US, the Computer Fraud and Abuse Act and state laws apply, alongside sector rules.
If you are unsure, ask before you touch. A short email to the owner is cheaper than a lawyer.