One of the most important things that has to be agreed before any
engagement and is often done as part of the contract negotiation is to
clearly define the scope of the assessment.
The scope will lay out exactly what buildings and floors and even
areas you can and, most importantly, cannot go into. This can be
very tricky with shared office spaces.
Sometimes a client may need to simulate an attack
via a third party in the building.
You'll obviously need to negotiate with other companies if this is the case. The
scope will lay out exactly what you are trying to achieve.
Is it simply gain access to a building or a specific room? Or
is it a target more specific, such as remove this particular
folder from the building? Or an even more complex scenarios,
such as enter this building, gain access to this room,
plug in a network device, set up a small team within the finance
department and see how long before people notice? Some of the
things that I've been asked to do in my career include removing
gold bullion bars from a bank vault,
stealing a helicopter from a hospital, and even kidnapping key personnel.
It is very easy to break the law whilst doing these
assessments, and you should ensure that you are comfortable
with all areas of the scope before continuing.
It goes without saying that the scope of the work must be very clearly defined
and you should also ensure that as few people within the client know about the
engagement and its dates as this could either compromise you or the engagement
or allow people to alter the results.
This can happen, and has even happened to me twice before,
resulting in an invalid test,
as well as a large bill for the client with nothing to show for it.