Читать книгу CompTIA PenTest+ Certification For Dummies - Glen E. Clarke - Страница 56

In addition to determining the target audience for the penetration test and the reason the pentest is being performed, it is also important to determine who the penetration testing team is to communicate with during the pentest. This includes determining when updates are delivered to the contact person and also who to contact when there is an emergency (such as a system or network crashes due to the pentest).

Following are some common questions you can ask during the pre-engagement phase to determine communication paths:

 How frequently should updates on the progress of the penetration test be communicated?

 Who is the main point of contact in the company for communication updates?

 Are the penetration testers allowed to talk to network administrators and the security team, or is this a silent pentest?

 Who should be the point of contact in case of emergency?

As a pentester you also want to be sure you have collected proper contact information in case there is an emergency, such as a system goes down or an entire network segment goes down. Following is the key information you should collect about the customer in case of emergency:

 Name of the company contact

 Job title and responsibility of the contact

 Does the contact have authorization to discuss details of the pentest activities?

 Office phone number, mobile phone number, and home phone number of the contact

Another reason to communicate with the customer is to let the customer know if something unexpected arises while doing the pentest, such as if a critical vulnerability is found on a system, a new target system is found that is outside the scope of the penetration test targets, or a security breach is discovered when doing the penetration test. You will need to discuss how to handle such discoveries and who to contact if those events occur. In case of such events, you typically stop the pentest temporarily to discuss the issue with the customer, then resume once a resolution has been determined.