Before we dive into the Metasploit Framework,
I want to take a few moments to discuss ethics, their importance,
and their application through codes of conduct.
Ethics are really driven by the information security
industry's expectations of how security professionals
conduct themselves during their work.
Most professional organizations define those
expectations through a code of conduct.
In the case of penetration testing,
it's about making the right choices in how we use powerful
tools that can provide unauthorized access,
deny services, and possibly destroy data.
While this isn't a philosophy course studying Hume or Kant,
I find moral reasoning directly applicable here.
You will no doubt encounter several dilemmas,
which will require you to consider the ethical code and use your moral
reasoning in weighing your actions against the consequences.
All of our testing tools can be used to strengthen the
security and resiliency of systems,
but in the wrong hands or used with the wrong intent,
they can be used to compromise systems and obtain
unauthorized access to sensitive data.
Consider carefully how you would use these tools.
Let's explore two specific codes of conduct that are relevant
to the information security profession.
First,
we'll look at the EC‑Council's Code of Ethics and then one from the (ISC)2.
If you decide to invest your time in certification through
the Certified Ethical Hacker program,
then you'll be bound to the EC‑Council's Code of Ethics.
This code of ethics is really geared for the penetration testing professional.
I would encourage you to review it because it provides a lot of details
associated with ethical concerns that you will encounter in your career as a
penetration tester. (ISC)2 also has a code of ethics.
While not designed for penetration testing specifically,
this code is very simple and broad enough to cover most of
the ethical concerns that you will encounter as an
information security professional.