In this lesson,
we're going to cover everything you need to know
about planning a penetration testing engagement.
The planning phase is important
because it lays the groundwork for the entire engagement,
ensuring that both the client
and the pen tester are on the same page,
and that all legal and ethical considerations are addressed.
Now, when planning an engagement, defining the scope
is one of the most critical steps.
The scope outlines what is
and isn't included in the penetration test.
This can involve identifying specific systems, networks,
applications, or areas to be tested.
So for instance, you might be tasked
with testing the security of a company's web application,
but to be restricted from testing their email servers
or internal network.
This clear delineation of what is required
and what is not helps prevent any misunderstandings
or potential conflicts during the testing process.
Another important part of planning the engagement
is understanding and complying with legal
and regulatory requirements.
Depending on the industry and the geographical location,
there might be laws and regulations that govern
what you can and cannot do during a penetration test.
For example, if you're conducting a penetration test
for a healthcare organization in the United States,
you need to be aware of HIPAA regulations,
which require the protection of patient data.
The Rules of Engagement, or RoE,
are another critical component.
These rules outline the dos and don'ts for the pen test.
For example, the RoE might specify
that certain types of attacks,
like distributed denial of service attacks
or DDoS attacks are off limits
because they could disrupt business operations.
It might also outline the acceptable hours for testing
to avoid impacting peak business hours.
An essential document in the planning phase
is the Non-Disclosure Agreement, or NDA.
This agreement ensures that any sensitive information
the pen tester accesses
during the engagement remains confidential.
For example, if the tester discovers
the use of legacy end of life systems
that are essential for operations to the client system,
they cannot legally disclose this information
to any third parties.
The Statement of Work is another key document.
The Statement of Work outlines the specific task
and deliverables that the pen tester is responsible for.
It provides a detailed description of the services
to be provided, including timelines,
milestones, and payment terms.
For instance, the statement of work might state
that the tester will conduct a vulnerability assessment,
perform exploit attempts,
and provide a report within a four week period.
Additionally, it's important to establish
clear communication channels and escalation paths.
This means having predefined points of contact
within the client organization
and knowing whom to reach out to
in case of any issues or emergencies.
For example, if the tester encounters a severe vulnerability
that could lead to immediate data loss,
they need to know whom to inform with the client's team
to take swift action.
Finally, it's important to understand
the client's risk tolerance
and business impact considerations.
This involves discussing with the client
what level of risk they're willing to accept,
and what potential impacts on the business operation
they're prepared for.
For example, some clients might be comfortable
with a higher level of testing rigor,
even if it means occasional disruptions,
while others might prefer a more cautious approach
to avoid any business interruptions.
So remember, planning and engagement
involves defining the scope,
complying with legal requirements,
establishing the rules of engagements, securing NDAs,
detailing the statement of work,
setting up clear communication channels,
and understanding the client's risk tolerance.
By carefully planning these aspects,
you can ensure a successful
and professional pen testing engagement
that meets the client's needs and expectations.