In this section of the course,
we will dive into the basic activities that set the stage
for a successful penetration test,
commonly referred to as pre-engagement activities.
Pre-engagement activities are the basic tasks
that set the stage for a successful penetration test.
These activities help us break down the complexities
of preparing for penetration tests.
Pre-engagement activities are important
for the alignment, legality, and success of a pen test.
Our focus in this section
will be centered around Domain 1: Engagement Management.
In this section,
we'll be focused specifically on Objective 1.1 and 1.2.
Now, Objective 1.1 states that we must be able
to summarize pre-engagement activities.
This objective emphasizes the significance
of laying a solid foundation
before launching into an actual penetration test.
This includes getting yourself familiar
with relevant regulations, frameworks,
and standards related to privacy and security,
ensuring stakeholder alignment,
and understanding the technology to be able
to thoroughly perform different assessments
on things such as physical and wireless networks,
applications, mobile devices, web apps,
cloud-based technologies,
as well as testing the strengths of the owner's APIs.
Objective 1.2 states that we must be able
to explain collaboration and communication activities.
This objective highlights the importance
of effective collaboration
and communication among all parties involved.
This encompasses agreements
such as NDAs or Non-Disclosure Agreements,
MSAs or Master Service Agreements,
Statements of Work, and Terms of Service,
along with authorization letters,
mandatory reporting requirements,
and describing the responsibilities of hosting providers,
customers, penetration testers, and third parties.
Throughout this section,
we'll also address important elements
like risk to the penetration tester,
establishing an escalation path, exclusions, test cases,
escalation processes, testing windows,
goal reprioritization,
and conducting a business impact analysis.
Additionally, we'll cover the technical aspects
of identifying site arranges, domains, IPs,
and URLs, essential for scoping the test accurately.
As we begin, we'll first explore the landscape
of regulations, frameworks, and standards
that govern the privacy
and security dimensions of penetration testing.
Understanding these guidelines is indispensable
for a penetration tester, as your role
involves navigating through a vast amount of legal
and ethical considerations
while trying to identify vulnerabilities
in the client's infrastructure
that could be exploited by the bad guys.
Following this, we'll jump into the importance
of stakeholder alignment,
emphasizing the importance of clear communication
and collaboration from the beginning of the engagement.
This ensures that everyone involved, from senior management
to the IT staff and external testers,
shares a common understanding
of the engagement goals, scope, and expectations.
We then will discuss the ever-evolving strategy
of how to stay in scope while testing in the cloud.
This will include things
such as understanding hosting provider responsibilities,
customer responsibilities,
penetration tester responsibilities,
and third party responsibilities at large.
Finally, we will take a short quiz to see what you learned
during this section of the course
and review each of those quiz questions to fully ensure
that you can explain why each answer was right.
So, if you're ready, let's dive into our lessons
focused on pre-engagement activities.