Question

What laws might prohibit one from conduction a network penetration test?

Answer 1

There are federal laws that govern penetration testers in the USA and some states have their own additions. It is said that the USA have some of the most complex cyber laws in the world. A quick summary of the US Federal laws a penetration tester should be aware of are:

• Title 18 of the Criminal Code, Sections 1029 prohibiting fraud in relation to access devices, account numbers, passwords, credit cards etc.
• Section 1030 prohibits unauthorized computer access for government, financial and commerce systems.
• Section 1362 prohibits injury or destruction of communications equipment.
• Section 2510 prohibits unauthorized interception of traffic There are also clauses to enable service providers to monitor, and procedures for law enforcement to gain access.
• Section 2701 prohibits access to stored information without permission of owner.
• Cyber Security Enhancement Act (2002) covers attacks which recklessly causes or attempts to cause death and has severe penalties including life in prison!