1
00:00:00,580 --> 00:00:04,300
‫So these are the steps you should take while planning a pen test.

2
00:00:04,720 --> 00:00:06,040
‫We'll see them here in detail.

3
00:00:07,530 --> 00:00:11,190
‫The first step of planning a pen test is to identify the needs of the customer.

4
00:00:12,110 --> 00:00:19,190
‫Here I use the word customer as the owner of the IT system that you perform a pen test for.

5
00:00:20,170 --> 00:00:26,350
‫Of course, the customer's basic need is to identify weaknesses in the information system and take measures

6
00:00:26,350 --> 00:00:27,970
‫before a real attack occurs.

7
00:00:29,850 --> 00:00:36,030
‫But here we should find the methods and targets, according to the customers sensitive topics, for

8
00:00:36,030 --> 00:00:36,420
‫example.

9
00:00:36,780 --> 00:00:44,640
‫Who is the most important threat for the customer, an insider, an employee of that company or an outsider?

10
00:00:46,070 --> 00:00:50,210
‫What is the most important asset that the customer wants to protect?

11
00:00:51,050 --> 00:00:54,910
‫A customer database, financial records, et cetera, et cetera.

12
00:00:56,930 --> 00:01:03,860
‫From physical security to web applications, there are a lot of different topics and infrastructures

13
00:01:03,860 --> 00:01:06,500
‫that may be subject to the bend test.

14
00:01:08,430 --> 00:01:12,000
‫There are a few factors to decide the scope of the pen test.

15
00:01:13,240 --> 00:01:17,050
‫The first factor, of course, is asset groups of the customer.

16
00:01:17,710 --> 00:01:23,620
‫And by that, I mean, you cannot test the wireless systems if the customer doesn't have a wireless

17
00:01:23,620 --> 00:01:24,190
‫network.

18
00:01:24,790 --> 00:01:25,180
‫Right?

19
00:01:26,470 --> 00:01:31,000
‫But generally speaking, of course, a customer will decide the scope, but please remember.

20
00:01:31,270 --> 00:01:36,040
‫In most cases, you should guide them to decide the correct scope.

21
00:01:37,910 --> 00:01:40,820
‫You should prepare everything you'll need in the pen test.

22
00:01:41,390 --> 00:01:46,070
‫In addition, you should inform the company to be prepared for the pen test as well.

23
00:01:47,830 --> 00:01:55,240
‫On the pen tester side, you'll need the attacker system, such as laptop, external disks, USB sticks,

24
00:01:55,240 --> 00:02:00,970
‫etc. and you should be sure that all the necessary applications are installed on these systems.

25
00:02:02,260 --> 00:02:04,480
‫There's another important part of preparation.

26
00:02:04,840 --> 00:02:08,830
‫Do not forget to install an update, the software tools that you'll be using.

27
00:02:10,020 --> 00:02:10,830
‫Just double check.

28
00:02:12,240 --> 00:02:18,390
‫On the other hand, advise the owner of the IT system to have the following setups before the pen test.

29
00:02:19,790 --> 00:02:25,670
‫Monitoring solution to detect the attacks is as important as to prevent them.

30
00:02:26,240 --> 00:02:33,630
‫In addition, monitoring will let them know what you do throughout the pen test, since all the pen

31
00:02:33,650 --> 00:02:35,090
‫tests have some risks.

32
00:02:35,120 --> 00:02:41,240
‫It would be better that the owner of the ID system have an up to date backup so that they can prevent

33
00:02:41,240 --> 00:02:42,590
‫any possible data loss.

34
00:02:43,820 --> 00:02:48,080
‫And lastly, you should be ready for a service interruption during the pen test.

35
00:02:48,440 --> 00:02:52,520
‫So help the system owner to prepare an emergency response plan.

36
00:02:54,140 --> 00:02:58,340
‫Now, of course, we cannot perform everything we want during the test.

37
00:02:59,800 --> 00:03:04,300
‫Since we are under the rules of an agreement, we do have some restrictions.

38
00:03:05,050 --> 00:03:12,370
‫But please don't forget that the actions we perform an append test are totally illegal unless we have

39
00:03:12,370 --> 00:03:14,500
‫an agreement with the legal system owner.

40
00:03:14,800 --> 00:03:15,100
‫Right?

41
00:03:16,320 --> 00:03:22,020
‫So these restrictions are mostly defined in the rules of engagement and of course, in the nondisclosure

42
00:03:22,020 --> 00:03:22,500
‫agreement.

43
00:03:24,070 --> 00:03:31,480
‫A non-disclosure agreement, NDA is a legal contract between the pen tester and the system owner that

44
00:03:31,480 --> 00:03:37,900
‫outlines confidential information that the parties wish to restrict access to or by third parties.

45
00:03:39,190 --> 00:03:45,040
‫You will probably access the most critical and confidential data of the system owner.

46
00:03:45,250 --> 00:03:49,900
‫So this agreement is very important, especially for this system owner.

47
00:03:51,470 --> 00:03:55,640
‫Rules of engagement will decide the limits of the pen test.

48
00:03:56,180 --> 00:04:02,810
‫It basically decides the scope, total test duration, the times that the attacks will be performed

49
00:04:03,200 --> 00:04:05,510
‫and the methods to be used.

50
00:04:06,170 --> 00:04:12,530
‫For example, you should identify whether the deduced the denial of service attacks will be performed

51
00:04:12,530 --> 00:04:15,800
‫as part of a pen test if it will be performed.

52
00:04:16,280 --> 00:04:22,670
‫The owner is probably going to ask you to perform the attack, probably at midnight of a particular

53
00:04:22,670 --> 00:04:23,180
‫weekend.