Re: Penetration testing scope/outline

[josh () dyadsecurity com]

Hi,
The scope of work in a penetration/security test is defined contractually before the start of the test and reflects an 
agreement between you and your customer regarding what work they want you to do and things like the times of day you 
are allowed to be running the test. An example of this is if they already know they are vulnerable to SQL Injection, 
they probably don't want you to be spending the entirety of the test owning them with SQL Injection because it's a 
problem they have already assessed and you would be providing them no value by doing so. The scope will vary from 
customer to customer so you can't set yourself up wrong off the bat by defining what you do during a pen-test before 
the dance of the mighty contracts. 

For documentation outlining a lot of what you might be looking for, I'd recommend you check out the Open Source 
Security Testing Methodology Manual (OSSTMM) at www.isecom.org. I expect it should be helpful.
-Josh


Billy Dodson(CraftedPacket () securitynerds org)@Tue, Oct 05, 2004 at 02:45:04PM -0000:
> Anyone have any documents they are willing to share on the scope of work
> for a pen-test?  I have looked online but was unable to find any available
> documentation.  If anyone could provide me with a some links or
> documentation outlining a pen-test/network audit it would be greatly
> appreciated.
>
> ------------------------------------------------------------------------------
> Internet Security Systems. - Keeping You Ahead of the Threat
>
> When business losses are measured in seconds, Internet threats must be stopped before they impact your network. To 
> learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, 
> download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security 
> technology. 
>
> http://www.securityfocus.com/sponsor/ISS_pen-test_041001
> -------------------------------------------------------------------------------

-- 
Josh Zelonis
Security Research, Dyad Security, Inc.
W - http://www.dyadsecurity.com
E - josh () dyadsecurity com

------------------------------------------------------------------------------
Internet Security Systems. - Keeping You Ahead of the Threat

When business losses are measured in seconds, Internet threats must be stopped before they impact your network. To 
learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, 
download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security 
technology. 

http://www.securityfocus.com/sponsor/ISS_pen-test_041001
-------------------------------------------------------------------------------