From: josh@dyadsecurity.com
Date: Tue Oct 05 2004 - 16:35:40 EDT
Hi,
The scope of work in a penetration/security test is defined contractually before the start of the test and reflects an agreement between you and your customer regarding what work they want you to do and things like the times of day you are allowed to be running the test. An example of this is if they already know they are vulnerable to SQL Injection, they probably don't want you to be spending the entirety of the test owning them with SQL Injection because it's a problem they have already assessed and you would be providing them no value by doing so. The scope will vary from customer to customer so you can't set yourself up wrong off the bat by defining what you do during a pen-test before the dance of the mighty contracts.
For documentation outlining a lot of what you might be looking for, I'd recommend you check out the Open Source Security Testing Methodology Manual (OSSTMM) at www.isecom.org. I expect it should be helpful.
-Josh
Billy Dodson(CraftedPacket@securitynerds.org)@Tue, Oct 05, 2004 at 02:45:04PM -0000:
> Anyone have any documents they are willing to share on the scope of work
> for a pen-test? I have looked online but was unable to find any available
> documentation. If anyone could provide me with a some links or
> documentation outlining a pen-test/network audit it would be greatly
> appreciated.
>
> ------------------------------------------------------------------------------
> Internet Security Systems. - Keeping You Ahead of the Threat
>
> When business losses are measured in seconds, Internet threats must be stopped before they impact your network. To learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security technology.
>
> http://www.securityfocus.com/sponsor/ISS_pen-test_041001
> -------------------------------------------------------------------------------
>
-- Josh Zelonis Security Research, Dyad Security, Inc. W - http://www.dyadsecurity.com E - josh@dyadsecurity.com ------------------------------------------------------------------------------ Internet Security Systems. - Keeping You Ahead of the Threat When business losses are measured in seconds, Internet threats must be stopped before they impact your network. To learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security technology. http://www.securityfocus.com/sponsor/ISS_pen-test_041001 -------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:07 EDT