Lesson 5.5: Permission, scope and rules of engagement
What a written authorisation must say, who can give it, what scope and rules of engagement are, and what to do when you find something outside them. In the lab you prepare for a real-looking internal test: read the signed scope, notice the window hasn't started yet, and turn a colleague's careless target list into one that contains only what you may touch.
17 min
You will learn to
- List what a written authorisation must contain
- Explain who has the authority to give permission
- Define scope, exclusions, time window and rules of engagement
- Filter a target list against a scope
- Know what to do when something is out of scope
Key terms
- Written authorisation
- A signed document in which the system owner allows a specific test.
- Authority to consent
- Only someone who owns or legally controls the system can allow a test of it.
- Scope
- Exactly what may be tested: addresses, domains, applications, and what is excluded.
- Rules of engagement (RoE)
- How the test may be done: time window, allowed and forbidden techniques, what to do if something breaks, how to communicate.
- Out of scope
- Anything not explicitly included. Out of scope means no permission.
- Emergency contact
- The person you call at once if the test causes a problem or you find a live attack.
← File and directory permissions · All lessons · Changing users: su and sudo →