All language subtitles for 001 Scoping an Engagement (OBJ 1.1, 1.2, and 1.3)

-: In this section of the course,

we're gonna cover the various considerations

that you need to think of when scoping and engagement.

Now, when we use the term scope

in the world of penetration testing,

we're referring to the combined objectives and requirements

needed to complete an engagement.

From a business perspective,

it's important that both the client

and the penetration tester knows what is and is not

in the scope of a given engagement.

For example, if I hire you to perform a penetration test

of my website, we need to agree upfront

what portions of the website

you're gonna conduct your assessment against

and what type of tools and techniques

you're gonna be allowed to use against my website.

For example, I might allow you to conduct an SQL ejection

against my learning management system

but I'm not gonna allow you

to do a distributed denial of service attack

against my servers.

Now, the reason isn't that I'm afraid

of you taking my servers offline, but instead

it's that we use an elastic cloud-based architecture,

and if you start to run a DDoS attack against my servers

they're gonna automatically spin up new compute instances

to service all that new load.

This would in turn really increased my cloud hosting costs

for that month

and it really doesn't gimme any valuable information

during the penetration test.

So I'm gonna make that off limits.

Now, on the other hand,

if I wanted to stress test our systems

and see just how large of a DDoS attack we could withstand

then maybe we would agree to put that

back into the scope of the assessment.

But for most penetration tests,

you're simply not gonna be allowed to do a DDoS attack

because it could either harm the organization's business

or it'll simply waste a lot of their time and resources.

So in this section of the course,

we're really gonna focus on scoping

which is part of domain one: planning and scoping.

This section,

we're gonna be covering parts of objectives, 1.1,

1.2 and 1.3 that we didn't cover in the last section.

And this will also complete our coverage

of all of the domain one objectives

that will be covered on your PenTest+ exam.

This includes objective 1.1,

which states that you must be able to compare

and contrast governance, risk and compliance concepts.

Objective 1.2, that states you must be able to explain

the importance of scoping

and organizational or customer requirements.

An objective 1.3, that states given a scenario

you must demonstrate an ethical hacking mindset

by maintaining professionalism and integrity.

As we begin this section, we're gonna first talk about

how you can define the scope of an engagement

by working with your client to determine what will

and won't be covered during a penetration test.

It is always important that you have defined

and agreed to the proper scope before any technical portions

of your penetration test have begun.

Then we're gonna move into the types of devices, systems

and programs that may be added to your target list

when you're scoping your engagement.

This includes things like wireless networks, IP ranges,

domains, APIs, physical locations,

internal targets, external targets

and targets that are either first party hosted

or third party hosted.

Next, we're gonna move into identifying the restrictions

that may be placed upon you during an engagement,

things like geographic restrictions,

the types of tools you can and cannot use,

and the different laws

that may affect your penetration tests.

After that, we're gonna discuss the rules of engagement

that you're gonna need to follow along with a discussion

of the different types of assessments

that you and your client may agree to use

during this engagement.

We're also gonna discuss the methods that you can use

to validate the scope of the engagement.

Finally, we're gonna discuss the different limitations

that could be placed on the penetration tester

for this engagement and the necessity of gaining permission

from the client before and during

different parts of the engagement to avoid fees, fines

or possible criminal charges.

So let's continue our coverage of domain one

with scoping and engagement in this section of the course.