Hi, I'm Alex Tushinsky.
In this module, we will review the various documents and legal
requirements necessary for a penetration test.
Today, we're looking at documents. Specifically, we're going
to discuss the non‑disclosure agreement,
also known as the NDA.
We will look at the master service agreement,
the statement of work, rules of engagement, and the communications plan.
Depending on whether you're a freelancer or work as part of an organization,
some of these documents may not directly apply to you,
but they will be part of the engagement in one form or another. And we'll
review each one so you'll have a full understanding of why they're
important and what purpose they serve. And when we talk about rules of
engagement and the communications plan,
I'll also mention some considerations that may be important if the pen
test you're about to conduct involves a third‑party cloud providers
such as Microsoft Azure or Amazon's AWS.
Let's begin by getting acquainted with the various
documents and where they fit in.
While not the most exciting aspect of our work, the documents
we're about to discuss set the stage for a successful pen
test and keep us out of trouble.
First, there are the legal requirements.
We,
as pen testers, need to be protected, and we need assurances that the work
we're about to perform, which may be destructive at times, is in line with
what the client wants and that we would not be held responsible for data,
servers, or anything else we may be able to get into. At the same time,
sharing the finer details of how an organization works, its data, or how an
organization's software or network function are typically considered guarded
secrets.
Imagine doing a pen test for Coca‑Cola and finding the secret recipe. For a
company to be comfortable with the test, they must have legal protections in
place as well, and so part of the focus for the documentation we're about to
discuss is to protect us legally.
Then there are also the project specifications.
We need to know what is in or out of scope.
And by defining this on a piece of paper and having that paper approved,
we're getting ourselves and our client on the same page.
There's no confusion around what work needs to be performed or why.
Additionally, we may have some requirements around how we get paid,
what hours we work, and what happens if we can't get support from the
client and can't complete the test as a result. These things are also
part of the documentation that we're talking about. Today, we're talking
about four specific documents, and the first two are part of the pen
test pre‑engagement. Here, we're establishing a non‑disclosure agreement
and getting our MSA, or master service agreement, approved through legal.
Once the MSA and NDA are set up, we're now working as part of the engagement.
In other words,
even though we still have some documentation to deal with, we are now in the
engagement. The client can tell us confidential things, and our MSA or work
standards have been accepted, so what's left is to understand what the client
wants and create a statement of work,
which helps us define the exact scope and document this
as part of our rules of engagement.
Now before we go forward, I wanted to also mention that I'm not a lawyer.
So while I've spent a great deal of time working with all of these documents,
you definitely should consult a real attorney when it comes
to the legal aspect of some of these.
If you're working on your own set of documents,
you can start with a template and customize it to suit your needs,
but have an attorney review and adjust it to make sure that it
protects you and your clients properly.