Chapter 10 — Engineering ethics and safety
Lesson map
Lesson 10 published. Map, example, EX028.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Authorization is not enthusiasm"]
N2["10.2 Dual use and teaching"]
N3["10.3 Stop conditions"]
N4["10.3b Dual control for dangerous verbs"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX028"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Authorization is not enthusiasm"]
N2["10.2 Dual use and teaching"]
N3["10.3 Stop conditions"]
N4["10.3b Dual control for dangerous verbs"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX028"]
[Learning outcomes]
|
v
[10.1 Authorization is not enthusiasm]
|
v
[10.2 Dual use and teaching]
|
v
[10.3 Stop conditions]
|
v
[10.3b Dual control for dangerous verbs]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX028]
Learning outcomes
You will (1) refuse dual-use and out-of-scope requests; (2) apply stop conditions without waiting for a meeting; (3) document consent and authorization so a review can reconstruct them.
10.1 Authorization is not enthusiasm
A manager saying "go ahead" in chat is not written authorization. NIST SP 800-115 and PTES expect a signed scope, methods, dates, limits, contacts and stop conditions. Without that document, the engineer stops. Enthusiasm from a single stakeholder who does not own the asset is a common path to unauthorized testing.
Chat messages vanish, lack scope detail and rarely name stop conditions. A signed document can be shown months later when someone asks why a host was touched. Stopping without that document is not stubbornness; it is the only move that keeps the engineer and the client inside the law. Sam keeps the signed ROE hash in TrackScope next to every run.
10.2 Dual use and teaching
This book teaches scoping, measurement and reporting. It does not teach exploit development, weaponised payloads or bypass recipes. When a peer asks for "just the PoC", the answer is the finding description and the evidence reference, not a working attack. Publishing student work that contains live techniques against real products is a disclosure decision with vendors and law, not a homework upload.
The refusal protects classmates, future employers and vendors who never agreed to be homework targets. A finding description plus an evidence reference lets a peer learn what was wrong without receiving a ready-made attack. When coursework might touch a real product, Sam routes it through the same disclosure path a professional engagement would use. Course labs stay on synthetic systems for that reason.
10.3 Stop conditions
Stop conditions are pre-agreed triggers: probing a deny-listed host, latency above a threshold, a safety alarm, or a request from the client contact. When a trigger fires, stop first, then notify. TrackScope should enforce hard denies in software so "I forgot" is not a failure mode.
"""Evaluate proposed actions against synthetic rules of engagement."""
ROE = {
"hours": ("09:00", "17:00"),
"deny_actions": {"denial-of-service", "phishing-staff", "exfiltrate-real-data"},
"require_approval": {"password-spray-lab", "privilege-escalation-lab"},
"max_concurrency": 5,
}
proposals = [
("service-enum", "10:30", 3, False),
("denial-of-service", "10:30", 1, False),
("password-spray-lab", "10:30", 2, False),
("password-spray-lab", "10:30", 2, True),
("service-enum", "18:00", 2, False),
("service-enum", "11:00", 20, False),
]
def ok_time(t):
return ROE["hours"][0] <= t <= ROE["hours"][1]
for action, when, conc, approved in proposals:
reasons=[]
if action in ROE["deny_actions"]: reasons.append("deny-action")
if action in ROE["require_approval"] and not approved: reasons.append("needs-approval")
if not ok_time(when): reasons.append("outside-hours")
if conc > ROE["max_concurrency"]: reasons.append("concurrency")
print(f"action={action:20} when={when} conc={conc:2} approved={approved} -> {'ALLOW' if not reasons else 'DENY'} {','.join(reasons) or '-'}")
Expected output:
action=service-enum when=10:30 conc= 3 approved=False -> ALLOW -
action=denial-of-service when=10:30 conc= 1 approved=False -> DENY deny-action
action=password-spray-lab when=10:30 conc= 2 approved=False -> DENY needs-approval
action=password-spray-lab when=10:30 conc= 2 approved=True -> ALLOW -
action=service-enum when=18:00 conc= 2 approved=False -> DENY outside-hours
action=service-enum when=11:00 conc=20 approved=False -> DENY concurrency
Synthetic case — Riverstone Transit. At 11:10 the scan touched 10.20.0.1 (deny-listed). TrackScope denied further actions; Sam escalated; the client confirmed. Resume required an updated ROE line, not a verbal "it's fine".
The lab shows denies for banned actions, missing approval, wrong hours and excess concurrency. Software enforcement means the stop happens even if the human is tired or distracted. Notify after stop, not before, so the harmful action does not continue while someone looks for a meeting slot. Sam tests the deny path in staging with a deliberate banned action before each engagement.
10.4 Errors and limits
Ethics is not a chapter you finish; it is a constraint on every later chapter. Legal text here is orientation, not advice — consult counsel for real engagements.
Later chapters on tools and methods inherit these limits; none of them override a missing ROE. Orientation text cannot replace counsel when a real contract is on the table. Sam escalates legal questions instead of inventing answers from a textbook paragraph, and he revisits consent when scope changes mid-engagement, before any new action runs.
10.3b Dual control for dangerous verbs
Actions that change authorization — publishing a new ScopeVersion, disabling a stop condition, exporting a sealed dossier — require two authenticated people or a time-delayed single control with a cancel window. Engineering convenience is not an argument against dual control when the blast radius is the client's estate.
One tired engineer should not be able to widen scope for an entire estate. A second person, or a delay that allows cancel, turns a mistake into a recoverable event. Publishing a new ScopeVersion and exporting a sealed dossier both change who can see what, which is why they sit on the dual-control list. Sam logs both approvers on every such action.
Exercises
- EX028 — Refuse. Write a two-sentence refusal to a request for a working exploit against a vendor product for a graded assignment. Rubric: 3 = refuses, offers allowed alternative (finding text / synthetic lab), cites safety; 2 = refuses without alternative; 1 = vague; 0 = provides exploit.
- EX029 — Stop. From the lab, which actions are denied and why? Rubric: 3 = DoS always; password-spray without approval; outside hours; concurrency; 2 = three; 1 = one; 0 = wrong.
- EX030 — Authorization fields. List six fields a signed ROE must contain. Rubric: 3 = systems, methods, dates, rate/data limits, contacts, stop conditions (or equivalent six); 2 = four; 1 = two; 0 = none.
Synthesis
Written permission, stop conditions and a refusal habit are safety engineering, not bureaucracy.
Continue studying — chapter 10 of 50
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →