>> Before we get started with Nmap,
I'd like to talk briefly about the ethics
and legality of hosts and network scanning.
I'm not a lawyer, so if you
have any questions about legal stuff,
please find a good one and consult with them.
But whatever you do,
please make sure you understand
the legal ramifications of scanning
>> before you continue with this course.
>> Thank you.
>> In this lesson, I'll talk to you
about the ethics of scanning using Nmap,
then we'll compare and contrast
that with the legalities of scanning.
Next, I'll provide you with some reasons
>> why you may want to seek legal advice.
>> Then I'll talk to you about
>> the biggest piece of advice I can give you,
>> obtain written authorization
>> from the owner of any target
>> you wish to scan prior to scanning it.
>> Next, I'll preach to you about being good.
Finally, I'll provide you with
some really good references about the ethics
and legalities of scanning with Nmap.
>> Let's get started.
>> Is scanning ethical?
>> In my opinion, it is in most cases,
>> but this certainly depends on
>> who is performing the scan,
>> where they're performing it, and why.
Nmap was created to help network administrators
>> and security professionals build
>> and maintain great networks with secure hosts.
>> Unless you're running intrusive scans
or scans that are intentionally designed
>> to exploit some hosts vulnerabilities
>> or deny service to its users,
I believe scanning is ethical.
For example, let's say that I'm interested
>> in finding all live hosts on
>> my company's network as a part of my job,
as a network security admin.
Running a quick ping scan of my network using Nmap
>> will provide me with a very fast inventory
>> of every host that responds.
The load that it places on the network
>> and its hosts is very low.
>> In most cases, especially
when you adjust the timing of the scan,
the scan won't even set off an IDS alarm.
There is simply no reason that
a scan like this could be considered unethical.
With that said, not all scans are created equal.
When is it unethical?
Well, I think the rule of thumb here is
scanning is unethical if your intentions are bad,
if you don't understand the ramifications of your scan
>> or if your scan has the possibility of exploiting
>> a vulnerability or denying service to its users.
However, you need to know
that scanning with Nmap is still
a somewhat controversial topic
>> and what I think is ethical or unethical
>> makes little difference to the legal community.
>> Let's talk about the legalities
>> of network scanning a bit.
>> The next question we should answer is,
is scanning with Nmap legal?
Well, for the most part the answer is yes.
In the United States,
>> there are no federal laws that
>> explicitly criminalize port scanning.
With that said, though,
the use of Nmap as a scanning tool,
has caused both criminal and civil suits.
For example, in 1999,
a guy named Scott Moulton initiated a scan
>> that was related to
>> a public network he was setting up.
A competing consulting company,
noticed the scan because
>> they maintained a web server on that network
>> and pushed for both civil
>> and criminal suits to be filed.
>> They were eventually dropped,
but not without a prolonged fight
and a lot of money paid to lawyers.
The criminal suit sided
the Computer Fraud and Abuse Act of America,
Sections A5-B,
which applies to anyone who intentionally accesses
>> a protected computer without authorization,
>> and as a result of such conduct causes damages.
As I see it though, the big problem
was that the only damages
>> that can be proven were the time
>> and resources spent by his competitor
>> in the investigation of the scan,
>> no breach occurred,
no exploitation attempt was launched,
and no service was denied to users.
Scott's win in the end
>> was huge for ethical users of Nmap,
>> and he's gone on to do bigger and better things.
But the point here is that in the US
>> and many of his locales,
>> people can use
>> the legal system to harm ethical IT people
>> to serve their own unethical purposes.
>> Scanning is always legal
>> when you've obtained written authorization
>> to perform the scan
>> and you've generated a statement of work
>> that includes details of the types
>> of scans you have initiated.
It's also always legal
>> when you're performing it within your own home,
>> on computers and networks that you own.
It's also almost always legal
when performing those scans as a part of
your job responsibilities as laid out
>> by your job description
>> and does not go beyond
>> your company's network perimeter.
>> You should always look at your companies policies,
>> your job description,
>> and get written approval
>> from your boss before initiating a scan at work.
>> If you're at school, similar rules apply.
When is it illegal?
I would say that it could be considered illegal
>> and can bring civil or criminal charges
>> if any harm or damages can be proven.
It entirely depends on the parties
involved and jurisdictions affected.
If you think it might be considered illegal,
>> don't do it.
>> I wish I could be more specific than that,
but the Internet is still a little like the wild west
>> and different law enforcement,
>> lawyers, judges, and juries interpret our aging
>> and inadequate laws in different ways.
>> It simply can't be expected
>> to understand the technicalities of scanning.
>> Always air on the side of caution,
and perhaps my best advice is on the next slide.
Seek legal advice.
>> After all, like I said, I'm not a lawyer.
>> If and or when you seek legal advice,
make sure you find a lawyer that has experienced
>> with the prosecution or defense of civil
>> or criminal suits related to network scanning
>> or if this proves impossible,
>> at least seek guidance from a lawyer
>> that has prosecuted or defended any IT related suits.
>> Because different locales have different laws,
make sure that the attorney works
>> or has worked in the jurisdiction
>> in which you intend to launch your scan
>> or where the target resides.
As I mentioned before,
there are no laws that explicitly criminalize scanning,
but a good attorney can provide
much better guidance on this than I ever could.
Remember, civil lawsuits can be brought
against anyone at anytime for any reason.
They are very rarely thrown out
>> or considered frivolous even with weak evidence.
>> This is especially true in IT related suits
>> because even modern judges tend to be old school
>> and lawsuits will almost always be very expensive
>> to defend if one is brought against you.
>> Besides seeking sound legal advice
from a competent attorney,
my only other advice is to make sure
>> you have really good insurance
>> that will pay for the defense of such a suit
>> should it unfairly be brought against you.
>> I mentioned this before,
but I want to mention it again
>> because it's so important.
>> Obtain written authorization from those who own
>> or operate any host that you intend to scan
>> prior to launching the scan.
>> This is ethical
>> and provides you with good legal protection.
>> If you're scanning hosts on networks that you maintain,
make sure it's in your job description
>> and get written authorization unless you own it.
>> If your scan goes beyond your network perimeter,
and even if you or your company
owns the scanning station and the target,
make sure you check your ISP's acceptable use policy.
In some cases, your ISP may shut off service,
if they detect network scans
>> they deemed to be a threat.
>> As rare as this is,
you should still check to make sure before you launch.
This may be overly simplistic,
but my other piece of advice is simply to be good.
There are too many bad guys out there.
Please be one of the good guys.
Have a legitimate reason for your scans
>> and make sure that it doesn't involve doing harm,
>> avoid noisy and/or intrusive scans.
I'll talk about these later,
but they could include
>> operating system discovery scans,
>> advanced or aggressive scans,
certain NSE scripts, scanning a huge network
>> or too many ports or setting the timing
>> of the scan too aggressive or insane mode.
In other words, practice polite scanning.
This means that you should target your scans tightly.
Only scan the host from which you want to gather
information and limit the number
of ports you're scanning, if possible.
For example, don't scan a slash 16 network
>> if you're only interested
>> in information from a slash 24.
>> If you're only interested in web and email services,
just scan relevant ports like 25,
110, and 80, for example.
Use a timing of dash T2 or less if possible.
I'll talk more about timing later,
but basically the number next to the T indicates
how aggressive the scans packets are crafted
>> and can be anything from 0-5.
>> The higher the number, the more aggressive it is.
Finally, don't depend on this,
but Nmap has built-in features
that are intended to prevent crashing targets.
Practicing polite scanning will reduce the possibility
>> that your scan will be noticed
>> and will have minimal impact on the networks
>> and host being scanned.
>> On this slide, I'm providing you
with some additional resources.
If there is only one reference that
I urge you to explore on this slide,
it would be the first one.
The creator of Nmap presents
a compelling case for every point
>> I've tried to express in this lesson.
>> He goes into much more detail without being too wordy.
I think you'll find it very informative
>> and well worth your time.
>> In this lesson, we discussed
the ethics of scanning using Nmap.
Then we compared and contrasted that
with the legalities of scanning.
Next, I provided you with some reasons
why you may want to seek legal advice.
Then I talked to you about obtaining
written authorization.
Next, I urge you to be good.
Finally, I provided you with some references
about the ethics and legalities of scanning with Nmap.
Thanks so much for going through this lesson with me,
and I'll talk to you in the next one.