All language subtitles for 006 Rules of Engagement (OBJ 1.2)

Instructor: After you've defined

and clarified the scope of the assessment,

you're then gonna need to agree upon the rules of engagement

for that penetration test with your client.

Now, the rules of engagement, also known as the ROE,

are the ground rules that both parties must abide by,

both the organization and the penetration tester.

Think of it like a soccer game

in which everybody needs to know and play by the same rules.

Everybody knows that the goalie is the only player

allowed to use their hands,

and so both teams understand this common rule,

and we can play the game accordingly.

Rules of engagement cover five key areas:

timeline, locations, time restrictions,

transparency and boundaries for the test.

Both the organization and the penetration tester

need to agree upon the timeline for the engagement.

A timeline is used to represent a series of events

that transpire within a discreet period of time.

This includes when the test will occur

and the total duration of the engagement.

Will the assessment be conducted

over a couple of days, a week, a month, or a year?

This will be negotiated as part of your contract,

and becomes part of your rules of engagement.

From this agreed upon duration,

the penetration testing team will then need to outline

what tasks are gonna be performed

and estimate the amount of time required

for each task to be completed.

For instance, if a phishing campaign is gonna be utilized

as part of a social engineering assessment,

will those emails all be sent out at the same time,

or are we gonna spread them out over several days or weeks

in an attempt to be more covert and more likely effective?

Once the timeline of events is created,

this will often be provided to the trusted agent

within the targeted organization

to aid them in deconfliction and to get their concurrence

before we execute the assessment.

Now, when completed, the timeline should include

the date and time that each task is gonna begin,

its estimated duration, a brief description of the task,

and who's responsible for performing that task

within your penetration testing team.

The second major concern is the location.

Will the penetration testing team be conducting the attacks

on site or from a remote location?

If the target organization has multiple locations,

will the pen tester be required

to go to every single location or to test all the locations,

or will they just use a sample set,

or maybe just the corporate headquarters?

The rules of engagement will specify

which locations are authorized to be targeted

and which ones are considered off limits and out of scope.

As a penetration tester, it's always important to consider

if any of the target locations are located

across international borders as well.

For example, some organizations have offices in California,

London, and Hong Kong.

Now, each of those three locations

will require the penetration tester

to become familiar with the laws and regulations

that are applicable in those areas.

All authorized locations should be listed

in the rules of engagement,

especially any that cross international borders.

The third key area in the rules of engagement

is time restrictions.

Now, time restrictions are used to specify certain times

that the penetration tester is authorized

or unauthorized to conduct their exploits and attacks.

For instance, if a company always does server maintenance

on Saturday nights from midnight to 2:00 AM

and they can't afford any additional downtime

during those hours, the targeted organization may specify

that the penetration testers

simply can't conduct their assessments during those hours.

Another example is if the target organization

is typically a business organization,

and they may allow us to attack during weekends and holidays

when a large portion of their staff are not at work.

As a penetration tester,

I really love conducting assessments during a holiday period

because there's less people working and the ones who are

are really not paying that close of attention.

Conversely though, if we're conducting

the PCI DSS compliance for a retail organization

and we wanna conduct our attack on Christmas Eve,

well, guess what?

That retailer is probably gonna disapprove that

because they don't wanna take anything offline

or lose sales during one of their busiest days of the year.

It all comes down to what the organization

and the penetration tester are going to agree upon.

Now, with all that being said,

if your client does not maintain an operation

on a 24/7, 365 type of schedule,

you should really explain to your client's key stakeholders

the importance of conducting the penetration test

during their normal business hours.

By conducting the test during their normal business hours,

the organization's reaction to an attack

can be more clearly measured

because those defenders are there during the day at work

during that potential attack and exploits

that you're creating during the engagement.

Whichever timeline restrictions are agreed upon

should clearly be stated inside of your rules of engagement.

For example, there might be a line

in that document that says,

activities for the engagement will be conducted

only on weekdays from 9:00 AM to 5:00 PM US Pacific time,

unless otherwise stated

and approved within an individual test plan.

This would mean that the bulk of the engagement

is going to happen during normal business hours,

but maybe you have an individual test plan

that you wanna try and conduct a physical penetration test

of their data center at 2:00 AM on a Sunday

because there's not as many people there

and you need the cover of dark to make that happen.

If that plan gets approved,

it's gonna be okay to do that

outside of normal business hours

because it is a separately approved test plan

that's meeting the goal.

Now, our fourth area to consider is transparency.

We need to know who in the target organization

is going to be told that an engagement

is scheduled to occur or is ongoing.

Now, some organizations will keep this information

confidential and highly controlled

so that only senior executives,

like the chief security officer

or chief technology officer

are gonna be aware of the engagement.

Other organizations though

may tell some of their system administrators

or their director of information technology

that this is gonna happen.

Again, this really depends on the rules of engagement

that are gonna be established

and the objectives of the overall assessment.

Now, this person inside the organization

that you're allowed to communicate with,

we call them a trusted agent.

This trusted agent is an in-house staff member

who's gonna be designated as a monitor

in the organization during this assessment.

It's really important to work with that trusted agent

before, during, and after the engagement to ensure success.

Now, this person is somebody

who's inside the targeted organization,

and they're gonna receive all the details

of the penetration test while it's being conducted.

They are empowered to communicate

directly with the penetration testing team

so that the attacks can be deconflicted,

and if there's any negative effects

on the operational network,

the penetration testers can be told

to stop their exploitations that are in progress

while the organization recovers their systems

back to normal operations.

The trusted agent can also provide the penetration testers

with resources if you're doing a known environment test,

things like network diagrams, source code,

and a list of the operating systems.

Now, if the objectives require

an unknown environment test though,

those type of resources are not gonna be provided,

and the penetration testers will instead be required

to conduct the assessment in the blind.

The final area that we need to think about

is one of boundaries.

Now, what exactly will the penetration tester

include in the assessment?

Now, this will already be covered

inside of your statement of work,

but in the rules of engagement,

you should also include any rules about what you can

and cannot test from a technical, physical,

or operational perspective.

For example, is the penetration tester authorized

to conduct social engineering

as a method of gaining access to the network,

or are they only allowed to use

openly available technical exploits?

Some organizations simply wanna see

their technical vulnerabilities,

and therefore, they're gonna exclude

social engineering attacks, like phishing,

from your assessments.

These organizations aren't necessarily concerned

with testing their user awareness.

Instead, they wanna see if their systems

are correctly configured to prevent somebody

from attacking outside of the corporate network

to inside the corporate network.

Again, this comes down to agreeing

to the boundaries for the assessment

in order to meet the engagement objectives.

Remember, boundaries are used to refer

to what systems may be targeted

and what techniques can be utilized.

If we're doing a physical security test,

are we allowed to climb their fence?

Well, maybe we can.

Maybe we can't, but the boundaries established

in the rules of engagement will confirm what is authorized.

(gentle music)