Читать книгу CompTIA Pentest+ Certification For Dummies - Glen E. Clarke - Страница 85

Maintaining professionalism and integrity is critical to the success of any company performing a penetration test, and to the pentesters themselves. For a penetration test to be successful, you should follow these guidelines to maintain professionalism and integrity:

 Perform background checks of the penetration testing team. Ensure you perform background checks and criminal records checks on all members of the penetration testing team.

 Adhere to the specific scope of engagement. Ensure the scope of the engagement is followed at all times. It is important to monitor adherence to the scope throughout the penetration test.

 Identify criminal activity. During a penetration test always keep a close eye out for any criminal activity against the target.

 Report breaches and/or criminal activity immediately. If you notice a prior security breach on a target or any criminal activity against a target, pause the penetration test and immediately report the evidence of a prior compromise or criminal activity to the client.

 Limit the use of tools to a particular engagement. Ensure you limit the use of tools used during a penetration test to the tools that should be used based on the scope of the test. For example, if the RoE states that there should be no DoS attacks against systems, then ensure none of the tools are DoS tools.

 Limit invasiveness based on scope. Remember to limit the type of testing to testing that matches the scope of the engagement.

 Maintain confidentiality of data and information. Always maintain confidentiality of the penetration test including data and information found and the results of the penetration test.

For the PenTest+ certification exam, remember that if you see evidence of a prior compromise or criminal activity, you should pause the penetration test and report the evidence to the client.