This next document,
the Rules of Engagement, or ROE, is a critical piece of
documentation that you can't do without.
In fact, you can't start to do any actual pen testing work until
this document is signed by you and the client.
The Rules of Engagement provides protection for you, the ethical hacker. This
document identifies the scope of the pen test and lists out the exact targets
and types of tests that you'll be performing.
It is absolutely required before you begin any tests.
Additionally,
if the pen test includes social engineering or on‑site work that could be
viewed as breaking and entering or other illegal activity,
the ROE document is your get‑out‑of‑jail‑free card. Remember that
not all employees will be privy to the test being conducted, and
if you get caught by one of them,
they aren't just going to take your word for it.
You'll need to prove to them that you're legitimate, and this
is the document that provides that detail.
Oh, and it must be signed and accepted by you or your company and the client
and both should have copies. This document defines the exact attack surface,
lists out anything that is out of scope, again,
reiterates any disclaimers, may include a communications plan, and
includes the client's signature as an acceptance of the terms.
Several years ago, if you wanted to perform a pen test against
Microsoft Azure environment,
you had to let Microsoft know. This was twofold. First, they
wanted to know because they have defenses in place that
would identify you and block you.
And secondly, because they wanted to control what you can and cannot attack.
So if you're working with a cloud provider such as AWS or Microsoft Azure,
check with them to see what they require and issue the appropriate notification.
Additionally,
the provider may send you their own Rules of Engagement document
that outlines what you're able to test and what you can't. Today,
Microsoft doesn't require you to tell them that you're going to pen
test an Azure environment,
but they do have a Rules of Engagement notice on their website. Use
a search engine to look for Microsoft Cloud Penetration Testing
Rules of Engagement, and you'll see what they list as items that are
in scope and also out of scope.