Cyber ethics and law
You learn authorisation, scope, responsible disclosure and cybercrime law through international examples, and make ethical, lawful decisions in your work.
Level 101 · 23 lessons · 21 practice labs
Lessons
Ethical foundations
- Why ethics matter so much in security: You can explain that security knowledge can protect or harm, and why trust is the foundation of the profession.
- Tools for ethical thinking: consequences, duty, character: You weigh a dilemma by consequences, duties and character and reach a reasoned decision.
- Dual-use knowledge and tools: You see how the same tool serves defence or misuse and can set limits on your own use.
- Professional codes of ethics: ISC2, ISACA, EC-Council: You compare the ethics codes of the main professional bodies and apply their shared principles to your work.
- Quick task: assess dual-use cases
Authorisation and scope
- Authorisation is everything: permitted versus unpermitted testing: You can explain with examples how the same technical work is a profession with written permission and may be a crime without it.
- Scope documents and rules of engagement: You can prepare a scope document for a security assessment covering targets, time window, exclusions and contacts.
- Ethical hacker principles: do no harm, protect data, report: You know to leave personal data untouched during an assessment, leave no traces and report findings only to authorised people.
- Bug bounty programmes and safe harbour terms: You read a bug bounty programme’s rules and identify what is allowed and which terms protect you.
- Quick task: find the gaps in a scope document
Responsible disclosure
- Responsible (coordinated) disclosure: You know how to reach a flaw’s owner, how long to wait and when it can be made public.
- ISO/IEC 29147, security.txt and CVE records: You can explain the standard for receiving vulnerability reports, the security.txt file and what a CVE number is for.
- Hard cases: unresponsive vendors and exposed data: You can weigh which options are ethical and lawful when a vendor stays silent or you come across exposed personal data.
- Quick task: write a disclosure email and a security.txt
Cybercrime law
- Cybercrime law internationally: the Budapest Convention: Through the Budapest Convention, you can describe how countries handle cybercrime with shared definitions and cooperation.
- Country examples: US CFAA, UK CMA, EU directive, Türkiye’s Penal Code 243-245: You can compare how different countries define unauthorised access, data tampering and system disruption offences.
- Lessons from real cases: good intentions don’t replace permission: From cases of researchers prosecuted while trying to help, you can work out where they crossed the line.
- Privacy, monitoring and the limits of employee surveillance: You can balance security monitoring against employees’ private lives using the principle of proportionality.
- Quick task: map actions to offence categories
Evidence and accountability
- The legal value of digital evidence and chain of custody: You can explain how evidence must be collected, stored and recorded to stand up in court.
- Confidentiality duties and NDAs: You know when and to whom you may reveal information learned through work and how an NDA binds you.
- Reporting to authorities: police, CERT, regulator: You can tell when a cyber incident goes to the police, the national CERT or a regulator.
- Capstone: decide and justify an ethical dilemma case: You examine a case where an employee finds a flaw outside scope and write what should happen, with legal and ethical reasons.
Practice labs
- Consequences, duty, character: Match six short justifications to consequence-based, duty-based or character-based ethical reasoning.
- Sharing a dual-use tool: Weigh the decision to open-source a password auditing tool by benefit, harm and safeguards and write your decision.
- An instruction that conflicts with the code: Assess the case of a consultant whose manager asks them to drop a finding from a report against professional codes of ethics and write the course to take.
- Authorised or not: Mark ten testing activities as authorised or unauthorised against the given authorisation letter.
- Complete the rules of engagement: Add testing hours, banned techniques, contacts and stop conditions to an incomplete rules-of-engagement document.
- A test that strays out of scope: Compare a test log with the scope document, find the moments out-of-scope systems were touched and write the notification that is due.
- Read the safe harbour terms: Read a bounty programme's rules and decide which of five researcher behaviours stay within its safe harbour.
- A disclosure timeline: Prepare a coordinated disclosure timeline for a vulnerability with first report, reminder, fix window and publication dates.
- An unresponsive vendor: Compare the options of a researcher who has had no reply for three months by user risk and legal risk and recommend a justified course.
- Match actions to offence types: Match ten actions to illegal access, data interference, system interference or misuse of devices.
- The same act in three countries: Compare an unauthorised-access scenario against the example laws of the US, the UK and Türkiye in one table.
- Does good intent hold up: Assess the case of a student who scanned for vulnerabilities without permission and reported the result in terms of authority, harm and intent and write the legal risk.
- Is the monitoring proportionate: Judge six employee-monitoring practices as proportionate or excessive and give your reasons.
- Gaps in a monitoring notice: Review an organisation's employee-monitoring notice for purpose, scope, retention and access rights and list the gaps.
- The privacy line in an investigation: Assess a request to read an employee's personal messages in an internal investigation by legal basis, necessity and less intrusive options.
- Fill in the chain of custody: Fill in a complete chain-of-custody form from the account of a laptop changing hands.
- Find the break in the chain: Find the unsigned handover, the date inconsistency and the unhashed copy in a chain-of-custody record.
- Who to notify and when: For six incident scenarios, decide whether the police, the national response team or a regulator must be notified and in what order.
- Read what the NDA covers: Find the definition of confidential information, the term and the exceptions in an NDA text and write a one-page summary.
- Does this share break confidentiality: Mark eight sharing examples by a tester (conference talk, CV, chat group) as acceptable or a breach of the confidentiality duty.
- Plan data return and destruction after a test: Write a plan for returning and destroying the data left after a finished security test for Göktaşı Yazılım, including a destruction record.
About this course
You learn authorisation, scope, responsible disclosure and cybercrime law through international examples, and make ethical, lawful decisions in your work.
What you will learn
- Ethical foundations
- Authorisation and scope
- Responsible disclosure
- Cybercrime law
- Evidence and accountability
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.