Let's begin with the non‑disclosure agreement.
The non‑disclosure agreement is a legally binding document. Violation of this
document typically carries a set of penalties or remediations, which we agreed
to by signing the document in the first place.
In other words,
we agree to keep information given to us or obtained during the
pen test confidential. And if we fail at that,
the legal protections for the client kick in, and they may be
able to ask us to pay damages based on the severity of the
information we let out into the public.
There are two types of non‑disclosure agreements.
The unilateral is intended to prevent a single party from disclosing
information. In the case of a pen test, this is usually the pen tester
and the pen tester's firm. In this scenario,
the client is able to discuss the pen test with others and
can share details of the attack vector's tools or any other
information about the engagement.
The mutual NDA asks that both parties maintain confidentiality regarding the
engagement and protects both the client and the pen tester.
Okay, so what goes into an NDA? Well, first and foremost,
there's generally a section that describes the information in question.
What can't we talk about? The specifics are outlined and typically include
company‑specific proprietary information, as well as details about any
vulnerabilities you may discover. Next, there's a section that defines the
obligation that each party has when it comes to this data. To what level do
we need to protect this?
The scope of information includes the specifics of the first
section, things that could be identified as the data in question
from a legal perspective. An NDA usually includes a section on the
duration of confidentiality.
Can we talk about this in five years, for example,
in 10, or maybe never? And of course, there are
typically always exclusions or exceptions.
For example, I recently saw a video presented by a popular pen tester on YouTube.
He described a recent engagement where he was able to
hack into a company's domain controller.
While he did not discuss the specifics of the company or
their network or anything in detail,
he was able to discuss the steps he took to get to the domain
controller and so the attack vectors themselves anonymized were
excluded from the NDA. Lastly, there's the remedies.
This is the section that describes the punishment for
failing to adhere to the non‑disclosure terms.
Overall, this document is typically one to two pages in
length and is relatively standard,
meaning you can find pretty good templates online that require little
tweaking before being usable. As I've said before, however,
always have it checked or put together by an attorney who
specializes in documents of this type.