All language subtitles for 008 Legal Concepts (OBJ 1.1)

-: Before you conduct a penetration test,

it's imperative that you receive written permission

from the target organization.

This is what prevents a penetration tester

also known as an ethical hacker

or authorized hacker from going to prison.

Ethical hackers and penetration testers are separated

from the criminal unauthorized hackers by simply one thing.

Permission. In the industry,

we like to use the term

for this written permission as our get outta jail free card

because that's effectively what it is.

This written permission should include the names

of the company's organizations or individuals

that are authorized to perform the penetration tests.

It should also include what specific networks, hosts

and applications are to be included in the test.

It'll also include the period

of time that the authorization is valid for

and the proper data handling techniques

that will be required.

Additionally, the reporting guidelines

and the list of people to communicate with,

and the guidelines that state

when a test should be terminated will also be included.

It's always important to ensure that,

your client is aware that certain types

of testing during your engagement may cause damage

to their systems or the information they house.

While the penetration testers will always try

to make the effort to protect the systems

and their information, sometimes when a server is exploited,

it can cause other services to go offline.

For example, if I conducted an exploit

against your authentication server,

it may cause the users to be unable to log into your network

or even authenticate with the email server.

Both of these would have a direct impact

on your business's operations during a busy work day.

So, it's something that the client needs to be aware

of before the engagement begins.

Remember, written permission

for your engagement is usually obtained

as part of the contracting process.

There are four types

of legal contracts that are covered by the exam.

This is the statement of work,

the master service agreement, the service level agreement

and the nondisclosure agreements.

First, a statement of work or SOW.

Statement of work is a formal document

that details the task to be performed during an engagement.

This document is gonna provide the penetration tester

with what must be done to complete the assessment,

what is not allowed to be done,

and what work the company is willing to pay them for.

This is an important document

because if you've been asked to test a hundred servers

and you begin to conduct your assessment

and then, the company asks you to test another five servers,

this increases the scope.

You should now require them to sign a change order

or an addendum because those five servers were not part

of the original statement

of work that you were contracted to perform

and they just increased your workload by at least 5%.

The statement of work will usually contain a list

of deliverables as well, such as the final report

and the responsibilities of the penetration tester

and the client, as well as the schedule, the timeline

for payments and other terms that need to be agreed

upon before the engagement begins.

Second, we have a master service agreement.

Now, a master service agreement,

also known as an MSA is

a specialized type of contract that's used

by those who perform a lot

of work for the same organization.

A master service agreement is gonna act

as a framework agreement where most of the terms are agreed

upon upfront so that they can quickly issue new contracts

by using a short statement

of work to solidify any specific details

for a new engagement.

A master service agreement is normally gonna be used

to govern future transactions

and agreements with a client,

and it usually contains any requirements

that would be recurring in nature.

For example, a master service agreement might state

that the penetration tester has to be bonded

and insured for up to $5 million in damages

that they have certain permits, licenses

or certifications, and that they accept payment

on a net 60 term schedule

which means that payment will be received 60 days

after sending in an invoice.

A good example

of when a master service agreement will be used is

if an organization hires a penetration testing firm

to conduct quarterly assessments

on their PCI DSS network infrastructure.

This contract will specify the charge free assessment,

the scope, and other details,

but it's not gonna include specific permission, duration

or timeline because that would be negotiated in a statement

of work that's going out for each quarterly assessment.

This drastically speeds

up the contracting process because most

of the details have already been agreed to upfront

in the master service agreement.

The third type of contract we have is called an SLA

or service level agreement.

Now, a service level agreement is a commitment

between a service provider, in this case

a penetration tester, and a client.

The SLA would include not only the description

of the services to be provided under this contract

and their expected service levels, but also metrics

by which the services are gonna be measured,

the duties and responsibilities of each party,

the remedies or penalties for a breach of that SLA

and a protocol for adding or removing metrics.

A service level agreement is commonly used

for security as a service type

of products or penetration testing services.

For example,

I had a friend who owned a small penetration

testing firm that provided both penetration testing services

and remediation services.

For his penetration testing services,

he used an overarching master service agreement

with each of his clients,

and then, they would issue a statement

of work for each engagement during that year.

Now, in addition to this,

he also had an SLA and that SLA stated that

his firm would remediate any vulnerabilities that were found

during the penetration test within seven days

of their discovery if they were categorized

as a category two vulnerability or in three days

if it was considered a category one vulnerability.

Now, I've also seen some outside

in scanning products that continually scan your website

or network and provide you

with a weekly report of your vulnerabilities.

This type of service also usually comes

with a service level agreement.

The fourth type of contract we have is known

as a non-disclosure agreement or NDA.

Now, a nondisclosure agreement is a legal document

that's gonna stipulate that the parties will not share

confidential information, knowledge

or materials with unauthorized third parties.

You should expect to sign an NDA

for every penetration test that you're ever gonna perform.

These non-disclosure agreements are a form

of legal contract that are gonna outline

the confidential material or information

that you may be exposed to during the engagement

and what restrictions are being placed on that material.

If, for example, we're hired to assess the security

of Marvel Studios, we can't go and take a copy

of the new Guardians of the Galaxy movie

and distribute it to the internet without breaking that NDA.

That means we're gonna suffer the penalties

for doing so and breaching our NDA.

Now, furthermore, we can't go out and tell everybody

about an organization's vulnerabilities that we discovered

during our assessment either

because that would break our NDA.

If you break an NDA, you're gonna be subject to fines, fees

and even have your contract canceled depending

on how the NDA is written.

Now, just like an organization will almost always

ask us to sign a non-disclosure agreement,

we should also ask them to sign one too.

Your version of an NDA should require that

the organization not release our proprietary techniques.

The way we conduct our assessments

or even copies of our reports,

all of these are considered the intellectual property

of the penetration tester

and we don't want them being shared with our competitors.

By using NDAs between the penetration tester and the client,

both sides are basically saying,

I'll keep your secrets and you keep mine.

These nondisclosure agreements are put in place to help

ensure confidentiality during our penetration tests.

Confidentiality is the principle and practice

of keeping sensitive information private, unless the owner

or custodian of that data gives explicit consent

for it to be shared with another party.

During the planning stage of an engagement,

your team needs to gain a clear understanding

of what data is sensitive

to that organization that you're gonna be testing

and how you can best protect it.

For example, if your engagement is scoped,

so that you must download a copy of the database

in order to prove the data exfiltration was possible,

then you also need to ensure

that you exfiltrate it over a secure and encrypted channel

that you encrypt the database

when it's at rest on your system

and you protect it from being exposed to any third parties.

A big part of confidentiality is making sure

that all the data you collect before, during,

and after your penetration test is properly

secured and handled.

This usually involves encrypting the data at rest,

in transit and in processing.

Once the assessment is concluded,

you're also gonna need to securely wipe your systems

of all the client sensitive data

to ensure it doesn't fall into the wrong hands.