312-50V10 · Question #72
Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests…
The correct answer is D. Immediately stop work and contact the proper legal authorities. When a penetration tester discovers evidence of serious criminal activity such as human trafficking, legal and ethical obligations override the scope of the engagement and require immediate reporting to authorities.
Question
Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking. What should you do?
Options
- AConfront the client in a respectful manner and ask her about the data.
- BCopy the data to removable media and keep it in case you need it.
- CIgnore the data and continue the assessment until completed as agreed.
- DImmediately stop work and contact the proper legal authorities.
How the community answered
(23 responses)- A4% (1)
- B4% (1)
- D91% (21)
Why each option
When a penetration tester discovers evidence of serious criminal activity such as human trafficking, legal and ethical obligations override the scope of the engagement and require immediate reporting to authorities.
Confronting the client could compromise the integrity of evidence, alert the client to destroy data, and potentially put the assessor in a dangerous situation.
Copying data to removable media without authorization may constitute evidence tampering or unauthorized data exfiltration, creating significant legal liability for the assessor.
Ignoring evidence of a serious crime and continuing the engagement exposes the assessor to legal liability as an accessory and violates professional ethical obligations.
Penetration testers and security professionals have both ethical and legal obligations to report evidence of serious crimes discovered during an engagement, regardless of client confidentiality agreements. Continuing work or retaining the data could create legal liability, and confronting the client risks alerting them and allowing evidence destruction. The correct action is to stop immediately and contact law enforcement.
Concept tested: Ethical and legal obligations during security assessments
Source: https://www.eccouncil.org/code-of-ethics/
Topics
Community Discussion
No community discussion yet for this question.