Discussion 2

Topic 2: Ethics of Social Engineering when Pen Testing

Social engineering plays an important role in successful pen testing. However, a pen tester has to take care that they do not violate ethical and legal guidelines when employing social engineering. For example, in the United States, impersonating an individual within the organization under analysis requires managerial (written) consent to be legal. Under what circumstances (if any) would it be ethical to lie to employees of the company in order to complete a pen test? Is it ever acceptable to perform pen testing activities without getting written permission from organizational management? Why or why not?