Lastly, we have the communications plan.
One of the most important aspects of a pen test is communication.
You'll need to communicate with the people that help get you set up and
configured in the applications you're testing or the network.
You'll also need to communicate with executives and maybe even legal
and other roles within the client's organization.
So the communications plan defines a clear path for different levels
of communication that you're about to undertake.
Everyone, but in particular the client, need to agree to this plan.
The reason being is that if you report the wrong thing to the wrong person,
it may cause issues internally within the company.
So communicating the right message to the right person is very important.
I mentioned that there are different types of communications taking place.
So you'll need to have a point of contact for different
types of scenarios that you'll encounter.
Sometimes this is the same person for every type of issue,
and other times they are a group of different people.
First,
you want to outline who you would go to ask questions about the
environment or to get onboarded for an application.
Next, who gets the critical issues?
For example,
if you found a critical vulnerability and someone should patch it immediately,
who gets that call?
While it doesn't happen often,
you may come across illegal activity and should have a
safe venue for reporting that as well.
Then there's the question of the final report.
Depending on the type of tests conducted,
some employees may not be painted in a great light and
handing the report to them could be a bad idea.
So have a contact who gets the report.
Lastly, if you're planning on testing a cloud provider,
such as Microsoft Azure, get a contact that you can work with on the Azure team.
As part of the engagement, if working with a cloud provider,
first,
identify the provider's requirements for allowing you to perform the tests.
You may need approval from them,
which includes the identification of IP addresses and systems that you'll be
coming from so they can allow your traffic to proceed.
In many cases, if you don't announce yourself ahead of time,
you may end up being blocked before you get anywhere.
Typically scope is required.
They'll want to know what systems, network, or features you're going to target.
And lastly, artificial intelligence is a great thing.
Heavily employed in IDS, IPS, and firewall devices they scan through the traffic,
look for signatures and patterns,
and when they see you trying to break into something,
they very well may just drop your traffic,
even if you're on an allow list somewhere and have full approval.
Having a support contact at the provider helps a great
deal here in getting you back on track.