In this lesson,
we will explore the key documents used
to establish and manage professional relations
during a penetration test.
These documents include Non-Disclosure Agreements (NDAs),
Master Service Agreements (MSAs),
Statements of Work (SoWs) and Terms of Service (ToS).
Each document plays a vital role in clarifying the rights,
responsibilities and expectations for both parties involved
in a penetration testing engagement.
An NDA is a legally binding contract
that establishes a confidential relationship
between the parties involved.
In a penetration test, the main purpose of NDA,
is to ensure that any information discovered
during the test,
especially sensitive information
like critical vulnerabilities,
will not be disclosed without prior approval.
This agreement creates a trust-based environment,
which is essential for the exchange
of a list of vulnerabilities
and other findings we discover during the engagement.
For example, if during our engagement,
we discovered that the client is using
Linux Ubuntu 20.04 LTS,
which was recently discovered
to have a critical vulnerability.
The vulnerability details
that Netatalk did not properly protect an SMB
and AFP default configuration,
and that a remote attacker could possibly use this issue
to execute arbitrary code.
The NDA ensures that these findings remain confidential,
protecting both the client's business interest
and our team's unique methods of discovery.
The MSA sets the foundational terms
of the business relationships
between a service provider and the client.
It typically includes terms concerning project scope,
payment details, confidentiality clauses,
and liability issues.
In penetration testing,
MSA clarifies how engagements are conducted,
handles recurring costs,
and addresses any additional charges.
This document streamlines the process
by eliminating the need for separate contracts
for each new project or phase
saving time and reducing complexity.
For example, a PenTest firm might have a MSA
with a client that stipulates the terms
for monthly vulnerability assessments
and routine security audits, providing clear expectations.
Next, let's discuss the statement of work.
The statement of work details the specifics
of the project or service provided.
It outlines the objectives, deliverables,
scope of work, timelines, payment schedules,
and responsibilities of each party.
It also details the systems to be tested,
the testing methodologies, the expected deliverables,
and the completion timeline.
This document ensures all parties
have a mutual understanding of the project details,
helping manage expectations
and guide the project's execution.
For example, in a statement of work
where you perform a network security assessment,
it will specify you'll be using tools
like NMAP and Metasploit
targeting specific network segments
like the non-production environments,
and setting a timeline for testing phases, weekly meetings,
and how to report results.
From my experience, this can be a lengthy process,
especially if you're in a large organization
like the government.
So, following up and giving the contracts
to required equipment and access
is essential for ensuring things are done
in a timely manner.
And finally, let's discuss the terms of service.
The terms of service govern the use of the service provided
by the PenTest firm.
This agreement details the rules
and guidelines for using the penetration testing services,
including user rights, service limitations,
and the client's obligations.
For example, during a penetration test,
a PenTest firm might employ exclusive tools and techniques
to assess a client's network security.
The terms of service would clearly state the terms
under which these tools are used
and that they should not be reversed-engineered.
This ensures the client understands their role
in safeguarding any test data generated
and agrees not to disclose
or misused the sensitive security information
revealed during testing.
So remember, by understanding
and effectively utilizing NDAs, MSAs,
statements of work, and terms of service
is essential for establishing secure
and professional relations penetration tests.
These documents ensure clarity
and alignment between all parties,
safeguard our sense of information,
protect business interests,
and facilitate the successful execution
of a penetration test.