All language subtitles for 009 Limitations and Permission (OBJ 1.1 and 1.3)

-: During your penetration test, you may also find a lot

of confidential information about the target organization.

Remember, it is your responsibility

to safeguard this information

and if you're able to access an area

of their network you think you shouldn't be in,

it's important to notify the trusted agent

inside that organization immediately.

You wanna be careful not to have

the confidential information leak out onto the internet

because if there's an unauthorized disclosure by accident,

then your company could be held liable.

Again, make sure your lawyer has properly drawn up

your contracts to ensure your liability is limited

in the case of accidental disclosures

to minimize your exposure to fees and fines in this area.

When you're conducting your penetration tests,

you always need to ensure

that you're complying with the requirements

and performance standards that have been set forth

in any of your contractual documents.

This includes your statement of work,

your master service agreements,

your service-level agreements,

and non-disclosure agreements.

These documents help set forth the boundaries

of your relationship with your client organization

as well as the expectations that they should have

for your team and the results you're gonna deliver

at the end of the assessment.

In your contracts and final documentation,

you should always include any disclaimers

and liability limitations to also protect yourself

and your company.

Now, all of these contractual documents should be reviewed

by an attorney or lawyer before the client organization

and your company signs them.

Once both parties are comfortable

with the terms of the contracts, then they should be signed

and the engagement can officially begin.

Remember, these contracts serve

as your get outta jail free card

in the case that the engagement goes poorly.

So always ensure you have these signed documents,

granting you permission before you begin your assessment.

When you begin your engagement,

always maintain your professionalism

as a penetration tester.

You should seek to complete your tasks and tests as quickly,

efficiently, and effectively as possible.

There are a lot of moving parts to a penetration test,

so keeping good notes and documentation

of your activities is going to be essential

as this conducting proper time management.

Now, time management occurs not only

during the actual attack and exploitation phase

but also during the planning and scoping phase,

the information gathering and vulnerability scanning phase

and the reporting and communication phases too.

When you're working as a penetration tester,

always focus on the tasks you're assigned.

Try to avoid any distractions,

ensure you're following the plan timeline,

and keep any status meetings

with the team short and to the point.

As you will soon find out, there is always more work

to be done than time available,

so practicing these time management tips can really

help you become more effective as a penetration tester.

Now, during your penetration test, you're gonna have a lot

of restrictions placed upon you

based on the statement of work, the rules of engagement

and the scope that was agreed upon

with the client organization.

Your team will be limited to performing only

what is considered allowable tests.

Now, these allowable tests help to further define the method

of assessing the targets inside of the engagement scope.

For example, the list of allowable tests

might include things like social engineering,

injection attacks, buffer overflows,

and physical security testing.

While at the same time, it may prohibit specific tests

like a distributed denial of service attack.

Your team must also adhere to the scope

of the assessment as it was agreed upon

with the client in your contractual documents.

If a client attempts to have you expand your testing

outside the agreed upon scope, you need to explain

that you cannot do that due to legal reasons

and that the scope must be officially changed

in the contracts prior to you testing

those additional systems.

This will help protect you and your company

from liability and potential legal issues.

Also, when it comes to scope,

you need to be careful to limit the invasiveness

of your engagement based upon the agreed upon scope.

In coordination with your client,

you need to identify any sensitive

or mission critical systems that should either be excluded,

avoided or only targeted for specific types of attacks.

For example, you may be able to conduct an SQL injection

against a targeted credit card processor's database server

but you may be prohibited

from using a buffer overflow exploit

because that might be considered too invasive

or dangerous for that mission critical system.

During a particular engagement,

it's also important to limit the use

of specific tools for different types of engagements.

Now, for example,

if you're conducting a PCI DSS compliance scan,

you may be required to use certain tools

for that part of the engagement.

Conversely, if you're conducting a HIPAA

or GDPR compliance assessment,

you're gonna use different tools and techniques for those.

Always use the right tool for the right type of engagement

and don't carry data from one client's network

into another client's network

as you move from engagement to engagement.

Additionally, you need to recognize other restrictions

that may be placed on you

whether those are technically-based or location-based.

For example, if you're assessing

a car manufacturer's network,

they may place certain limitations on the different types

of tests or the locations for different tests

based on their unique industrial control systems

that are being connected

to their operational technology networks.

Now, a different client may have a legacy system

that still runs an older operating system

like an embedded version of Windows

and that would simply fail if it was tested

with some of our modern automated scanning tools

during a penetration test.

During these situations, you need to make sure

you're discussing them carefully with the client

in advance to clearly identify any restrictions

that you might need to add to your team's engagement plan.

For example, in a previous organization I worked at,

we were conducting penetration tests against numerous legacy

and ICS SCADA systems within our organization

and we decided to hire

some outside penetration testing team members

to supplement our internal pen testers.

Now, to protect the systems and the networks,

we had an approved list of commercial, open source,

and proprietary tools that were authorized for use

by our penetration testers who are gonna be assigned

to work on those specific systems.

In their contracts, we provide a list

of all the approved tools that we had

and added a clause that stated this.

If additional tools are needed for a specific test,

the penetration tester must submit the tool for review

along with the request for approval, with the rationale

for why a tool on the existing approved tool list

cannot meet the testing requirements.

Any tool not listed on the approved tool list

cannot be used on the production network

without written approval from the chief technology officer.

So as you can see, there are many different places

where restrictions and limitations will be placed

on your penetration testing teams.

Remember, it is better to ask permission

than to beg forgiveness when it comes

to the world of penetration testing.

My philosophy is that, if permission isn't in writing,

it really didn't happen.

I've been bitten too many times

by people giving their verbal approval

for my teams to go run and exploit

only to have them yelling at us 30 minutes later

when their network defense teams begin

to see negative effects that were caused

by that same exploit.

It is always better to be safe rather than sorry.

So take the extra time needed to get the written approval

before you officially begin your engagement

and then you can move safely

into your information gathering, vulnerability scanning,

creating your attacks, and running your exploits.

(cool music)