‫So these are the steps you should take while planning a pen test.
‫We'll see them here in detail.
‫The first step of planning a pen test is to identify the needs of the customer.
‫Here I use the word customer as the owner of the IT system that you perform a pen test for.
‫Of course, the customer's basic need is to identify weaknesses in the information system and take measures
‫before a real attack occurs.
‫But here we should find the methods and targets, according to the customers sensitive topics, for
‫example.
‫Who is the most important threat for the customer, an insider, an employee of that company or an outsider?
‫What is the most important asset that the customer wants to protect?
‫A customer database, financial records, et cetera, et cetera.
‫From physical security to web applications, there are a lot of different topics and infrastructures
‫that may be subject to the bend test.
‫There are a few factors to decide the scope of the pen test.
‫The first factor, of course, is asset groups of the customer.
‫And by that, I mean, you cannot test the wireless systems if the customer doesn't have a wireless
‫network.
‫Right?
‫But generally speaking, of course, a customer will decide the scope, but please remember.
‫In most cases, you should guide them to decide the correct scope.
‫You should prepare everything you'll need in the pen test.
‫In addition, you should inform the company to be prepared for the pen test as well.
‫On the pen tester side, you'll need the attacker system, such as laptop, external disks, USB sticks,
‫etc. and you should be sure that all the necessary applications are installed on these systems.
‫There's another important part of preparation.
‫Do not forget to install an update, the software tools that you'll be using.
‫Just double check.
‫On the other hand, advise the owner of the IT system to have the following setups before the pen test.
‫Monitoring solution to detect the attacks is as important as to prevent them.
‫In addition, monitoring will let them know what you do throughout the pen test, since all the pen
‫tests have some risks.
‫It would be better that the owner of the ID system have an up to date backup so that they can prevent
‫any possible data loss.
‫And lastly, you should be ready for a service interruption during the pen test.
‫So help the system owner to prepare an emergency response plan.
‫Now, of course, we cannot perform everything we want during the test.
‫Since we are under the rules of an agreement, we do have some restrictions.
‫But please don't forget that the actions we perform an append test are totally illegal unless we have
‫an agreement with the legal system owner.
‫Right?
‫So these restrictions are mostly defined in the rules of engagement and of course, in the nondisclosure
‫agreement.
‫A non-disclosure agreement, NDA is a legal contract between the pen tester and the system owner that
‫outlines confidential information that the parties wish to restrict access to or by third parties.
‫You will probably access the most critical and confidential data of the system owner.
‫So this agreement is very important, especially for this system owner.
‫Rules of engagement will decide the limits of the pen test.
‫It basically decides the scope, total test duration, the times that the attacks will be performed
‫and the methods to be used.
‫For example, you should identify whether the deduced the denial of service attacks will be performed
‫as part of a pen test if it will be performed.
‫The owner is probably going to ask you to perform the attack, probably at midnight of a particular
‫weekend.