Get It in Writing Before You Test (Rules of Engagement)

Why this matters

Pentesting without explicit written authorisation is illegal in most jurisdictions — the difference between security work and computer-misuse charges is a signed contract. Every engagement starts with a written Rules of Engagement (RoE): in-scope assets, out-of-scope assets, test windows, allowed techniques, emergency contacts, deliverable format. The RoE is the contract; nothing happens before it's signed.

Demo

Sample RoE clauses: 'Scope: *.acme.com web tier, excluding payments.acme.com. Timing: 22:00-06:00 GMT, Mon-Fri. Forbidden: denial-of-service, social engineering of customers (employees in scope), data exfiltration beyond proof-of-concept (1KB max). Emergency: +44 7700 900123, available 24/7. Deliverable: written report within 7 days of engagement end.'

Try it yourself

1. Draft an RoE for a hypothetical pentest of your own product. Include scope, timing, restrictions, emergency contacts.
2. Read the OffSec OSCP RoE template. Note what's pre-defined.
3. Discuss what changes when testing a third party's product (NDAs, indemnification).

References

• OWASP — Penetration Testing Methodology
• OSSTMM — Open Source Security Testing Methodology Manual