- [Instructor] All right, let's go over some of the details
related to planning and scoping a pen testing assessment.
And this also applies
for red teaming assessment as well, right?
At the end of the day, you actually have
to have an initial client meeting.
And whenever I put here client meeting,
that can be your boss.
If you're a full-time employee at a company,
it can be your chief information security officer
or you know, a director of cybersecurity
or whatever the title of that person actually has, right?
But at the end of the day, what you have to do is understand
what is the goal that they're trying to achieve
with that pen test, right?
There are a few questions that you always should ask.
What are the key assets that you're concerned about?
What are the things that you actually want
to find vulnerabilities?
What are the types of attacks and threats
that you're most concerned on?
And do you have any type of compliance requirements?
And remember, earlier in the course I mentioned
the types of pen testing.
You know, whether it's gold base or compliance checks.
Well, in this case, you know, maybe that you are being hired
because of some type of compliance requirement.
Now also, documentation review
is a very, very important phase.
Review all the system documentations
that they actually have,
in some cases, they may allow you
to obtain different network diagrams, part of the scope,
different application architectural diagrams,
or even API documentation,
whether it's a restful API with a swagger document
or GraphQL documentation for a GraphQL file, right,
or API rather.
Now, you may also ask for previous vulnerability assessments
or pen testing reports depending on the environment,
especially if you are a full-time employee
within an organization, you probably have access to those.
In many other instances, you may not have access
to that documentation per se.
Now, the other thing is, of course, checking other legal
and compliance check that may be pertinent
and relevant to your assessment,
and especially sign your contracts, your NDAs,
your persmission to test
or your scoping rules of engagement.
All the documents that I mentioned earlier today.
Now, here is the second phase is actually the scoping,
how you define the scope.
We already went over a few examples of scopes
for bug bounty, so I'm gonna be very brief in here.
But again, you know, what are the IP addresses,
the target applications, the user roles?
When will the test start and end?
This is the timeframe.
And this typically can be within a separate document
called the rules of engagement document,
or it can be one that is actually both combined,
the scope and the rules of engagement.
Also, the resource allocation, the names and credentials
of the penetration testing and the tools
that you will be using may be required
by your client to know
before you actually do the assessment.
The other thing is that provisioning any type of accounts
that may need to be provisioned.
In some cases, in order for you to do the testing
more effectively, they will potentially give you access
as a normal user to that web application
or to that environment.
And in that case, you actually can go a lot more deeper
and then find as many vulnerabilities as you can
or any type of misconfigurations
or security flaws and so on.
The other thing that you define in this phase
is the success criteria, right?
What are gonna be the key deliverables in this case,
the expected outcomes, any type of metrics of success,
and any type of percentage
of high risk vulnerabilities and so on.
That is very, very difficult in some cases,
because you don't know what you don't know, right?
You're not gonna know what type
of vulnerabilities you're gonna go encounter.
So in many cases, you may not encounter
any high risk vulnerability, right?
In some cases, actually you may, right?
So that is a very difficult step to take
whenever you're doing a planning
and scoping a pen testing assessment
or a red team assessment.
And in some cases, you know, this will come with experience.
You may have some type of disclaimers related to this type
of metrics for success, but there may be clients
that actually will ask you for that.
Then of course, you know, you finally, your plan,
you actually go over and present this
to the person that either hire you or your boss and so on,
and then you start the pen testing engagement
or the red team assessment
after the client approval of your plan.
So that is from a high level, how you plan and scope
a pen testing assessment within an organization.