Cybercrime, Misuse and Responsible Security Practice

Introduction

Digital systems support communication, commerce, public administration, healthcare and education. Their importance also makes them attractive targets for crime and misuse. Cybercrime includes unlawful conduct involving computers, networks, digital devices or data. Some offences are directed against systems themselves, while others use digital technology to commit traditional crimes such as fraud, harassment or extortion.

Cybersecurity professionals occupy a position of trust. They may possess technical knowledge, privileged accounts and access to sensitive information. The same skills used to secure a system can be misused to steal data, disrupt services or evade detection. Consequently, responsible security practice requires more than technical competence. It requires authorization, defined scope, respect for privacy, evidence preservation, legal awareness and professional judgment.

This chapter examines major forms of cybercrime and misuse and explains how lawful security testing differs from unauthorized activity. Because cybercrime law varies by jurisdiction, the terms used here describe widely recognized legal and professional categories rather than a substitute for local legal advice.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the nature and impact of cybercrime and computer misuse.
2. Identify unauthorized access, malware, fraud, identity theft, phishing, extortion, stalking and denial-of-service offences.
3. Distinguish authorized security testing from unlawful access or misuse.
4. Apply authorization, scope, rules-of-engagement and responsible-disclosure principles.
5. Recognize ethical, privacy, evidential and governance responsibilities in security work.

1. Cybercrime and Computer Misuse

Cybercrime may be classified according to the role played by technology:

The legal characterization of conduct depends on facts such as intent, authorization, harm, deception, possession and jurisdiction. A person need not successfully steal information to commit an offence: attempting unauthorized access, possessing criminal tools, conspiring with others or causing an attempted disruption may also attract liability under applicable law.

Unauthorized access

Unauthorized access occurs when a person intentionally enters, uses or remains in a computer system, account, application or network without permission, or exceeds the permission granted. Examples include guessing another person's password, using a stolen session token, bypassing access controls, or continuing to use an account after permission has been withdrawn.

Authorization must be genuine and specific. An employee authorized to read customer records may not be authorized to copy them for personal use. Similarly, permission to test a public website does not automatically authorize testing its payment provider, cloud environment or connected third-party service.

Unauthorized access can affect:

• Confidentiality: exposure of personal, financial or proprietary information.
• Integrity: alteration, deletion or corruption of records.
• Availability: interruption or degradation of services.
• Accountability: loss of reliable logs and uncertainty about who performed an action.

These objectives are often called the CIA triad. They help organizations evaluate both security controls and the consequences of an incident.

Malware

Malware is software or code designed to perform unauthorized, harmful or deceptive actions. Important categories include:

• Virus: code that attaches to another file or program and propagates when the host is executed.
• Worm: malware that self-propagates across systems or networks without requiring a host file.
• Trojan: malicious software disguised as legitimate software or content.
• Ransomware: malware that denies access to data or systems, commonly through encryption, and demands payment.
• Spyware: software that covertly monitors activity or collects information.
• Bot or botnet malware: code that places a device under remote control, often as part of a larger network.
• Rootkit: tools intended to conceal malicious presence or maintain privileged access.

Malware may enter through phishing attachments, vulnerable services, compromised software updates, removable media or malicious advertisements. Defences include secure configuration, patch management, application control, multifactor authentication, backups, endpoint protection, network segmentation and user awareness. No single control is sufficient.

Fraud and identity theft

Digital fraud involves intentional deception to obtain money, services, access or another benefit. Identity theft involves acquiring, using or possessing identifying information without lawful authority, often to impersonate a victim. Stolen credentials, identity documents, account recovery details and payment data can all support fraud.

Common forms include business email compromise, online investment scams, payment redirection, fraudulent online marketplaces and account takeover. A technically sophisticated attack is not required; social engineering and manipulation may be enough.

Organizations should reduce exposure by verifying unusual payment instructions through an independent channel, limiting privileges, monitoring transactions, protecting authentication factors and maintaining clear reporting procedures. Victims should preserve messages, transaction records, headers, URLs and timestamps rather than deleting evidence.

Phishing and social engineering

Phishing is deceptive communication intended to induce a person to disclose information, open malicious content, transfer funds or perform another harmful action. Spear-phishing targets a particular person or organization. Whaling targets senior decision-makers. Smishing uses text messages, while vishing uses voice communications.

Warning signs include urgent demands, mismatched domains, unusual requests for secrecy, unexpected attachments, pressure to bypass procedure and requests for passwords or multifactor authentication codes. However, grammar and spelling are no longer reliable indicators because criminal campaigns can be professionally written and assisted by automation or generative AI.

A sound response is to pause, verify the request using a trusted channel, report it to the organization and avoid forwarding malicious content unnecessarily. Security education should be accompanied by technical controls such as email authentication, attachment scanning, phishing-resistant authentication and least privilege.

Extortion and ransomware

Extortion uses threats to obtain money, action or silence. In cyber contexts, an offender may threaten to publish stolen data, continue an attack, expose embarrassing information or disrupt operations. Ransomware groups may combine encryption with data theft and publication threats, a practice often called double extortion.

Organizations should maintain tested offline or otherwise protected backups, incident-response plans, legal contacts, communications procedures and decision-making authority. Paying a demand does not guarantee deletion of stolen data, restoration of systems or future immunity. Payment may also create sanctions, money-laundering or other legal concerns depending on the jurisdiction and parties involved. Decisions require coordinated legal, executive, technical and law-enforcement advice.

Cyberstalking, harassment and technology-facilitated abuse

Cyberstalking is repeated or sustained digital monitoring, communication or intimidation that causes fear, distress or safety concerns. Conduct may include unwanted messages, location tracking, impersonation, publication of private information, account intrusion or abuse of smart-home devices. A single message may be unlawful in some circumstances, while repeated conduct is especially significant.

Organizations should treat reports seriously, preserve evidence, restrict abusive accounts and protect the victim from retaliation. Safety planning may include changing credentials from a trusted device, reviewing account sessions, disabling unnecessary location sharing and consulting law enforcement or specialist support services. Victims should not be expected to confront an offender or investigate alone.

Denial-of-service offences

A denial-of-service (DoS) attack attempts to make a service unavailable or unusable. A distributed denial-of-service (DDoS) attack uses many sources, often compromised devices, to generate traffic or requests. Attacks may target bandwidth, network protocols, applications or computational resources.

DoS attacks can cause financial loss, safety risks, contractual breaches and reputational damage. Organizations use rate limiting, traffic filtering, resilient architecture, content-delivery services, upstream provider support and incident runbooks to reduce impact. Testing a system's capacity without authorization can itself create an offence or breach contractual obligations, even if no lasting damage occurs.

2. Lawful Security Testing and Misuse

Security testing is a controlled process for finding weaknesses so they can be corrected. It becomes lawful and professional only when the tester has valid authority and follows agreed limits. A useful distinction is:

Terms such as “ethical hacker” or “white hat” do not create legal authority. Good intentions do not replace consent. A vulnerability researcher who discovers a flaw accidentally must not assume that further exploitation is permitted.

Authorization

Authorization should identify:

• the legal entity granting permission and the tester or testing team;
• the systems, domains, IP ranges, applications, facilities and accounts included;
• the purpose and type of testing;
• start and end dates, testing windows and emergency contacts;
• permitted and prohibited techniques;
• treatment of personal, confidential and regulated data;
• third-party approvals where infrastructure is hosted or managed by another party;
• reporting, evidence, retention and deletion requirements; and
• procedures for stopping the test when instability, exposure or harm occurs.

Authorization should be documented before testing begins. A verbal instruction may be misunderstood and is difficult to prove. Contracts, statements of work and rules of engagement should be reviewed by an appropriate authority, especially where regulated data or third-party systems are involved.

Scope and rules of engagement

Scope defines what may be tested; rules of engagement define how. For example, an organization may permit vulnerability scanning against a staging environment but prohibit exploitation against production. It may permit testing during business hours but prohibit load testing, phishing simulations or physical access attempts.

The principle of least privilege applies to testing as well as ordinary administration. Testers should use the minimum access, data and persistence necessary. They should avoid collecting unrelated personal information, refrain from changing data, and stop when proof of a vulnerability has been established. A proof of concept should demonstrate risk without causing unnecessary harm.

Responsible disclosure

Responsible disclosure is a process for reporting a vulnerability to the affected organization in a way that permits verification and remediation. A typical process is:

1. Confirm that the finding is credible without unnecessary exploitation.
2. Identify the appropriate security contact or vulnerability-disclosure program.
3. Report sufficient technical detail to reproduce and assess the issue securely.
4. Protect any acquired information and disclose only what is necessary.
5. Allow a reasonable coordination period, subject to the seriousness of the risk.
6. Maintain communication and agree on public disclosure, if any.
7. Publish only after considering user safety, remediation status and applicable law.

A disclosure policy may specify safe-harbor conditions, accepted targets, prohibited testing and communication channels. Researchers should read it carefully; a policy for one domain does not automatically cover related infrastructure.

Vulnerability severity and prioritization

A vulnerability's importance depends on more than technical novelty. Relevant factors include exploitability, required access, affected assets, confidentiality or integrity impact, availability impact, exposure, detectability and business consequences. Organizations may use a formal scoring framework, but a score is decision support rather than a legal conclusion.

A low-complexity vulnerability exposing sensitive health information may require faster action than a technically impressive issue in an isolated test system. Risk decisions should therefore combine technical evidence with asset criticality, regulatory duties and realistic threat information.

3. Investigation, Evidence and Professional Conduct

Incident response must balance speed with reliability. Investigators should preserve logs, system images, messages, email headers, access records, relevant screenshots and a timeline of events. Evidence handling should record who collected an item, when, from which source, how it was protected and any transfer or analysis performed. This supports integrity and potential legal proceedings.

Investigators must avoid unnecessary surveillance and collection. Privacy principles commonly require a lawful purpose, proportionality, data minimization, access controls, retention limits and transparency where appropriate. Employees should not casually search personal accounts or devices merely because they are available on a company network.

Professional conduct also includes:

• maintaining confidentiality;
• declaring conflicts of interest;
• documenting assumptions and limitations;
• separating facts from hypotheses;
• escalating safety-critical findings immediately;
• refusing requests that exceed authority; and
• seeking legal or managerial advice when uncertainty exists.

A security professional should be able to explain not only how an action could be performed, but why it is permitted, necessary and proportionate.

4. Illustrative Case: Unauthorized Testing of a Public Portal

Background

A small organization operates a public benefits portal. It publishes a general email address for security reports but has no formal vulnerability-disclosure policy. An independent learner notices that changing a number in a web address appears to display another user's document.

Problem

The learner is tempted to enumerate many document numbers and download samples to prove the weakness. That activity could expose personal data and might constitute unauthorized access, even though the portal is publicly reachable.

Analysis

The initial observation suggests a possible broken access-control vulnerability. The learner has no written authorization to access other users' documents. The fact that the URLs are predictable does not make the records public. Further enumeration would increase privacy, legal and operational risk.

Appropriate approach

The learner should stop after obtaining the minimum evidence needed to describe the issue, avoid downloading personal documents, record the affected URL and time, and contact the organization's security or privacy channel. The report should explain the suspected access-control failure, the safe reproduction steps using the learner's own account, potential impact and recommended urgency. If no channel exists, the learner may send a concise report to a verified organizational contact and retain records of the communication. Public disclosure should not occur while personal data remains exposed or before reasonable coordination.

Outcome

The organization disables the vulnerable endpoint, reviews access logs, assesses whether data was exposed, informs affected individuals where required and deploys server-side authorization checks. It later publishes a disclosure policy and tests the corrected control.

Learning points

1. Public availability is not equivalent to authorization.
2. Access-control testing should use the least intrusive proof.
3. Privacy obligations apply even when the tester is acting in good faith.
4. A clear report can help remediation without reproducing harm.
5. Organizations benefit from defined reporting channels and safe-harbor language.

5. Contemporary Developments and Governance

Automation and generative AI affect both attacks and defence. Criminals can generate persuasive messages, translate scams, automate reconnaissance and customize fraud. Defenders can use automation to detect anomalies, summarize alerts and prioritize vulnerabilities. However, automated tools can amplify errors, expose confidential data to providers, or scan systems outside intended scope. Human approval, logging, access restrictions and testing are essential.

Cloud computing and software supply chains create shared-responsibility challenges. A customer may configure an application, while a provider secures underlying infrastructure. Open-source components, managed services and application programming interfaces can introduce dependencies outside an organization's direct control. Contracts should address security responsibilities, notification, audit rights, data location and incident cooperation.

Organizations should establish governance through policies, training, asset inventories, risk assessments, access reviews, secure development practices, incident exercises and independent assurance. Compliance is not identical to security: meeting a checklist does not guarantee resilience, while a technically strong control may still fail if it lacks legal authority, documentation or accountability.

Practical Decision Framework

Before accessing, testing or disclosing anything, ask:

1. Who authorized this action? Is the authorization written, current and applicable to me?
2. What exactly is in scope? Are systems, data, techniques and dates clearly identified?
3. What is the least intrusive method? Can the issue be demonstrated without copying data or disrupting service?
4. What could go wrong? Consider privacy, availability, safety, third parties and legal exposure.
5. How will evidence be protected? Define collection, storage, access, retention and deletion.
6. Who must be notified? Identify security, legal, privacy, management and emergency contacts.
7. When must I stop? Establish triggers for instability, unexpected data exposure or scope uncertainty.

If any answer is unclear, pause and obtain clarification. Uncertainty is a reason to seek authorization, not an invitation to experiment.

Chapter Summary

Cybercrime includes both cyber-dependent offences and traditional crimes enabled by digital technology. Unauthorized access, malware, fraud, identity theft, phishing, extortion, cyberstalking and denial-of-service attacks can harm confidentiality, integrity, availability, privacy, finances and personal safety. Technical capability does not create permission.

Lawful security testing depends on documented authorization, precise scope, rules of engagement, least-privilege conduct, data minimization and responsible disclosure. Testers should use the least intrusive method that establishes risk, preserve evidence appropriately and stop when authority or safety becomes uncertain. Organizations should combine technical controls with governance, training, incident response and clear reporting channels. Ethical security practice is therefore a legal, technical and professional discipline.

Key Terms

Authorization: Permission granted by an appropriate authority to perform specified actions.

Botnet: A network of compromised devices controlled by an operator.

Computer misuse: Unauthorized or improper use of a computer system, network, account or data.

Cybercrime: Criminal conduct involving computers, networks, devices or digital data.

Cyberstalking: Repeated or sustained digital conduct intended to monitor, intimidate or distress a person.

Denial of service: An attempt to make a system or service unavailable to legitimate users.

Extortion: Obtaining money, action or another benefit through threats or coercion.

Identity theft: Unauthorized acquisition or use of identifying information to impersonate or benefit from another person.

Least privilege: Granting only the access necessary for an authorized task.

Malware: Malicious or unauthorized software or code.

Phishing: Deceptive communication intended to induce disclosure, action or compromise.

Ransomware: Malware that blocks access to systems or data, commonly demanding payment.

Responsible disclosure: Coordinated reporting of a vulnerability to support safe remediation.

Rules of engagement: Agreed conditions governing how an authorized security test is conducted.

Scope: The systems, data, methods and time period included in an authorized activity.

Spear-phishing: Targeted phishing directed at a particular person or organization.

Social engineering: Manipulation of people to obtain information, access or an action.

Unauthorized access: Entry, use or continuation in a system without valid permission.

Review Questions

Short Answer Questions

1. What is the difference between cyber-dependent and cyber-enabled crime?
2. Define unauthorized access and give one example.
3. What is phishing, and how does spear-phishing differ from it?
4. Why is written authorization important in security testing?
5. State three elements that should appear in rules of engagement.

Long Answer Questions

1. Explain how malware can affect confidentiality, integrity and availability, and discuss appropriate organizational controls.
2. Discuss the legal and ethical distinction between a vulnerability researcher and an unauthorized attacker.
3. Explain the responsible-disclosure process and the risks of premature public disclosure.
4. Analyze the relationship between identity theft, fraud and phishing.
5. Describe how an organization should prepare for ransomware and cyber-extortion.

Analytical / Application Questions

1. You discover that a public application reveals another user's record when a parameter is changed. What actions should you take, and which actions should you avoid?
2. A manager asks you to conduct a “quick scan” of a supplier's servers without contacting the supplier. Analyze the authorization, scope and third-party risks.
3. An organization receives a DDoS threat accompanied by a demand for payment. Develop an immediate response that addresses technical, legal, evidential and communication requirements.

Multiple Choice Questions with Answers

Question 1

Which situation best illustrates unauthorized access?

A. Reading a public security policy

B. Using an account after permission has been withdrawn

C. Testing a system within a written engagement

D. Reporting a suspected vulnerability privately

Correct Answer: B. Using an account after permission has been withdrawn

Question 2

What is the defining feature of a worm?

A. It requires a host file to propagate

B. It disguises itself as legitimate software

C. It can self-propagate across systems or networks

D. It only encrypts data for backup purposes

Correct Answer: C. It can self-propagate across systems or networks

Question 3

Which action is most consistent with responsible disclosure?

A. Publishing stolen personal data as proof

B. Selling the vulnerability to an unknown buyer

C. Reporting sufficient details privately to the affected organization

D. Continuing exploitation until all systems are tested

Correct Answer: C. Reporting sufficient details privately to the affected organization

Question 4

Why does public availability of a URL not necessarily authorize access to the data behind it?

A. Public URLs are always encrypted

B. Availability and permission are different concepts

C. Only government systems require authorization

D. Authorization applies only to physical systems

Correct Answer: B. Availability and permission are different concepts

Question 5

Which item most directly defines the systems and methods included in a security test?

A. Scope and rules of engagement

B. A marketing plan

C. An employee holiday schedule

D. A software license invoice

Correct Answer: A. Scope and rules of engagement

Question 6

What is phishing primarily intended to do?

A. Improve system availability

B. Induce a person to disclose information or perform a harmful action

C. Create an authorized backup

D. Repair a vulnerable application

Correct Answer: B. Induce a person to disclose information or perform a harmful action

Question 7

Which control is especially relevant to reducing the impact of ransomware?

A. Untested online backups only

B. Protected and tested backups

C. Sharing administrator passwords

D. Disabling all incident reporting

Correct Answer: B. Protected and tested backups

Question 8

A DDoS attack generally attempts to do what?

A. Make a service unavailable by overwhelming resources

B. Authenticate legitimate users more quickly

C. Improve network resilience

D. Encrypt an organization's backups for recovery

Correct Answer: A. Make a service unavailable by overwhelming resources

Question 9

What does least privilege require during a security test?

A. Using every available administrator account

B. Obtaining and retaining all accessible data

C. Using only the access necessary for the authorized task

D. Testing every connected third-party system

Correct Answer: C. Using only the access necessary for the authorized task

Question 10

Which statement about ethical hacking is correct?

A. The label itself creates legal permission

B. Good intentions replace written authorization

C. Technical skill is sufficient regardless of scope

D. Lawful testing requires valid authority and compliance with agreed limits

Correct Answer: D. Lawful testing requires valid authority and compliance with agreed limits