‫Before beginning a pen test, the parties should enter into a contract indicating exactly what the pen
‫testers will do and will not do.
‫And the range of IP addresses, subnet computers, networks or devices that will be the subject of the
‫pen test.
‫The pen tester should obtain a get out of jail free card from the customer, specifically indicating
‫not only did the pen testing is authorized, but also indicating that the customer has the legal authority
‫to authorize the pen test.
‫Big distinction and very important.
‫If a cloud customer authorizes a pen tester to test their network in the cloud, this does not mean
‫that the cloud provider has authorized the test.
‫The cloud provider could go after the pen tester for unauthorized access.
‫A non-disclosure agreement and the.
‫It's also known as a confidentiality agreement.
‫It's a legal contract between the pen tester and the system owner that outlines confidential material
‫knowledge or information that the parties wish to share with one another for certain purposes, but
‫wish to restrict access to or by third parties.
‫As I mentioned before, you will probably access the most critical and confidential data of the system
‫owner.
‫So this agreement is very important, especially for the system owner.
‫Now, since penetration tests are very important for cybersecurity, it would be very good to have some
‫standards while performing the test steps, and thankfully we have several organizations and consortiums
‫to identify the standards.
‫The best known ones are.
‫PCI DSS says it's the payment card industry data security standard, PCI DSS is the worldwide payment
‫card industry data security standard that was set up to help businesses process card payments securely
‫and reduce card fraud.
‫Sad but true fact here that money seems to be the most important thing for human beings.
‫So these guys identify the standards of cyber security.
‫OWASP is the open Web application security project.
‫As a worldwide, not for profit charitable organization focused on improving the security of software
‫so you can find standards of application security right here.
‫Protests, penetration testing, execution, the standard was started as the brainchild of six information
‫security consultants attempting to address deficiencies in the penetration testing community in 2009.
‫Peters helps penetration testers adhere to best practices, so check them out.
‫Oh, double s t double m Open-Source security testing methodology manual.
‫Is methodology to test the operational security of physical locations, workflow, human security testing,
‫physical security testing, wireless security testing, telecommunications, security testing, data,
‫network security testing and compliance.
‫Nest, the National Institute of Standards and Technology, it's a physical sciences laboratory and
‫a non regulatory agency of the United States Department of Commerce.
‫Its mission is to promote innovation and industrial competitiveness.
‫They're very good at defining standards, so.
‫SBA 800 Dash one one five is a technical guide to information security, testing and assessment.
‫The purpose of this document is to assist organizations in planning and conducting technical information,
‫security tests and examinations, analyzing findings and developing mitigation strategies.