Overview
Authorization is the single most important concept in ethical hacking: explicit permission to test is what makes the activity legal. This lesson explains authorization — what it is, why it is mandatory, and what it must cover.
Learning objectives
- Define authorization in the testing context.
- Explain why written authorization is legally essential.
- Identify what proper authorization specifies.
Core concept
Authorization is the target owner's explicit, documented permission for you to perform security testing against specified systems. It is the legal basis for the entire engagement: without it, testing is unauthorized access — illegal in virtually every jurisdiction, regardless of good intentions. Authorization must be written, granted by someone with the authority to give it, and must define what may be tested, how, and when.
How it works
Before any testing, a written authorization (often within a contract, statement of work, or rules-of-engagement document) is obtained from the appropriate owner. It specifies the authorized targets, permitted techniques, timing, and constraints, and confirms the grantor's authority to permit testing of those systems. This document protects both parties: it legally sanctions the tester's actions and assures the owner of the boundaries. The tester must operate strictly within what the authorization covers — anything outside it is not authorized and therefore not legal.
Practical example
A client signs a document authorizing testing of specific applications in a staging environment, during set hours, with defined permitted techniques. This written authorization is what makes the tester's subsequent actions lawful. If the tester noticed an interesting but unauthorized system (say a partner's server), they would not test it — it is outside the authorization. The signed document is the tester's authority and boundary for every action.
Cybersecurity relevance
Authorization is the legal and ethical bedrock of all offensive security work. Unauthorized testing — even well-intentioned "helpful" probing — can constitute a computer-crime offense with serious consequences, and it is never acceptable on this platform or in professional practice. Proper authorization (written, from an authorized party, clearly scoped) protects everyone and defines the engagement. Every offensive technique taught in this path presumes valid authorization; obtaining and respecting it is the first professional obligation.
Common mistakes
- Testing without written authorization, relying on verbal or assumed permission.
- Accepting authorization from someone without authority to grant it for those systems.
- Acting outside the authorized targets/techniques/timing, voiding the legal basis.
Key takeaways
- Authorization is explicit, documented permission from an authorized owner to test specified systems — the legal basis for the engagement.
- It must be written, granted by someone with authority, and specify what/how/when testing may occur.
- Without authorization, testing is illegal regardless of intent; operate strictly within it, and never test unauthorized systems.
Check your understanding
- Why must authorization be written and granted by someone with authority over the target systems?
- What should a tester do upon noticing an interesting system that is outside the authorization?