97 Things Every Information Security Professional Should Know

Chapter 21. Lessons from Cross-Training in Law

Danny Moules

After I began my journey in law six years ago, working as a freelance consultant at the time, I was struck looking back retroactively at legal advice I had given. Law is one of those topics, much like security itself, where a little knowledge can be a dangerous thing. It can be difficult to know where to draw the line as a professional who needs to provide advice promptly but also correctly.

Legal issues around InfoSec, such as privacy, crimes, forensics, etc., form an important part of many InfoSec roles. At a fundamental level, have you ever been asked if one is allowed to “hack [x]”? I have seen many respond quite confidently from various angles. Such a question seems innocuous enough, but there are underlying issues that the industry and lawmakers in every country are still grappling with.

Take a pen tester’s perspective. Could you say, with legal certainty, a CFO (chief financial officer) is able to “authorize” the test? What if the scope included other parties? What happens if authorization is withdrawn during a test? I have seen many documents slapped together, often by people who couldn’t answer these questions if challenged.

On September 11, 2019, a penetration testing team from Coalfire was asked to perform a penetration test of a Dallas County courthouse. In the course of their scoping discussion, physical ...