Another piece we need to add to our list before stepping foot
into the client's site is a letter of authority.
This letter should be from the highest possible authority in the
company, unless someone of the C suite is part of the assessment.
This letter should state who you are,
who you work for, and a summary of the engagement.
It should also direct the reader of the letter to use the
internal phone directory to contact a list of people that
can verify the engagement.
Without this letter,
you could be arrested, or worse. Also, make sure you carry a
backup letter, as well as a list of emergency contact numbers
that are monitored 24/7 by the client.
If you are ever stopped whilst on site, do your best to talk out of it,
but ultimately avoid confrontation and produce your letter.
A test is still valid if you get caught.
You are, after all, trying to help the client understand where
their security weaknesses and strengths lay.
You are not there to boost your ego.
Whilst there are many interesting things you can do
during an engagement like this,
you must ensure that you only do what the client has agreed
you may do. Do not remove servers that are business
critical unless absolutely agreed.
Do not remove assets such as laptops unless agreed.
There are other ways in which you can provide proof that you
have gained access to specific locations.
Custom stickers are the best way that I find, along with a
photograph if possible. You can always show your client later on.
Whilst you may be simulating a criminal,
you do not have carte blanche to behave like one.
Always remember that the client's business critical systems and
the ability to continue their work is vital.
For example, I have performed many assessments against hospitals.
Here is a photo of my wife and I dressed in stolen scrubs.
But I couldn't begin to imagine the damage that removing a
surgeon's equipment would do,
which brings me on to what you shouldn't do and, more importantly,
how not to break the law.