Before running a password cracking tool on company systems to test for weak passwords, testers should obtain explicit permission.

• A. True
• B. False
• C. Not sure
• D. Only if policy permits

Answer: (A)

Before running a password cracking tool, testers must have explicit permission. Password cracking is an invasive test that touches credentials and can impact users and systems, so it requires clear, written authorization from the organization. This authorization defines the scope, allowed methods, duration, systems involved, and reporting requirements, providing legal protection and ensuring everyone is aligned on what is permitted. Without explicit permission, the activity could be illegal or breach contracts, even if there is a policy that mentions testing. The correct approach is to obtain that formal authorization before proceeding, and relying on policy alone isn’t enough.