Hired to break in
A bank hires a locksmith to try to break into its vault. The locksmith signs a paper first. The paper says which doors, which days and what is allowed.
Without the paper, the same act is a crime.
A penetration test works the same way.
By the end of this lesson
Note
I can say what must be agreed before a penetration test and what the final report holds.
Key words
| Word | What it means |
|---|---|
| Penetration testing | trying to break into a system, with permission, to find its weak points |
| Scope | what may be tested and what may not |
| Rules of engagement | the agreed rules for how the test is done |
| Contract | a written agreement between the tester and the client |
| Client | the organisation that asks for the test |
| Computer Misuse Act 1990 | the UK law that makes unauthorised access to computers a crime |
| Network | devices linked so they can share data |
| Report | a document that lists what was found and what to do about it |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Planning and scoping come first
Before any test, the tester and the client agree four things.
The scope: which systems and networks are in, and which are out. The rules of engagement: what the tester may and may not do. The timings: the days and hours. And the legal and contract matters.
What is agreed before the test
| Item | What it says | Example |
|---|---|---|
| Scope | What may be tested | Only the shop website at two named addresses |
| Rules of engagement | How the test is done | No attacks that bring the site down |
| Timings | When it happens | Weeknights after 10 pm |
| Legalities | Permission in writing | A signed letter from the owner |
| Contract | The duties of both sides | Keep all findings private |
The cells students fill in are left blank in this preview.
Why written permission matters
Important
Under the Computer Misuse Act 1990, getting into a computer without permission is a crime. A signed agreement is what turns an attack into a test.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.