All language subtitles for 001 Planning an Engagement (OBJ 1.1, 1.2, and 1.3)

-: In this section of the course,

we're gonna cover the various considerations

that you need to think of

when you're planning an engagement.

In the world of penetration testing,

the term engagement simply means

a singular penetration testing project that has been planned

and scoped by the client who's requested the test

and the analyst who are gonna do the testing and assessment.

Our focus in this section of the course

will be on domain one, planning and scoping.

Now we're gonna spend most of our time

in this section of the course talking about planning

because we're gonna be covering the concepts involved

with scoping and engagement

in the next section of the course.

So in this section, we're gonna cover parts of objectives,

1.1, 1.2, and 1.3.

Objective 1.1 states that you must be able to compare

and contrast governance, risk, and compliance concepts.

Objective 1.2 states that you must be able to explain

the importance of scoping and organizational

or customer requirements.

Objective 1.3 states that given a scenario,

you must demonstrate an ethical hacking mindset

by maintaining professionalism and integrity.

Now, as we begin this section, we're gonna first talk

about how risk is made up of threats and vulnerabilities.

It's important to understand this concept

as a penetration tester since your entire job

is focused on finding vulnerabilities

in your client's networks that can be exploited

by a threat actor.

In the case of a penetration tester, you're working

as an authorized threat actor who's trying

to identify the ways that an unauthorized intruder

could cause damage to the organization's network.

Then we're gonna move into the three types of controls,

which are categorized as either technical

or logical controls, physical controls,

or administrative controls.

These controls are important to understand

as a penetration tester because you're gonna be creating

a report for your client at the end of your engagement

where you're gonna be recommending different controls

across all three of these categories

in order to thwart a threat actor

from victimizing the organization's network.

Next, we're gonna move into understanding

the different steps in the penetration testing methodology

that we're gonna use in this course, and on the exam.

Also, we'll take a quick look

at some other penetration testing methodologies

that you may encounter when you're working

as a penetration tester in the real world

for a commercial firm.

After that, we're gonna discuss

how to plan your penetration test for the best results.

We're also gonna cover the legal and regulatory concepts

that are important to penetration testers

and briefly cover the ethical hacking mindset

and some concepts surrounding professionalism and integrity.

So if you're ready to get started

on your penetration testing journey, let's jump

into our lessons focused on planning and engagement.

(cool music)