Welcome to what I consider is probably one of the most important parts of this cause.
It's great to know all the technical concepts.
But if you don't know the legal concepts and report writing you're gonna be left behind very quick.
So let's talk about those.
Let's cover the common legal documents and I'll cover what I go through in a sales process and what
you're gonna see as a pen tester.
We'll talk about pen test reports et cetera.
So looking at these common legal documents I've broken them down into three sections there's sales there
is the before you test and the after you test.
Now as a penetration tester chances are you're only going to see the before you test and after you test
documents if you have some access to the sales side it's possible depending on your role and your function.
Most likely you're not going to see a lot of that stuff.
OK.
You might be aware of it but a lot of that contains sales information and legal information and things
that you know kind of that separation and duties where you might not need to know how much a contract
is worth or how a contract was written et cetera.
You will be privy usually to the rules of engagement and the findings report.
So let's talk about these in order.
So in a sales process the first thing that we might do is we might sign what is called a nondisclosure
agreement.
It's usually a mutual non-disclosure agreement.
And what that says is Hey I'm not going to take anything I've learned today and disclose it to anybody
else.
And I want you to do the same.
So this process usually goes something like this and I'll talk about my process as a business owner
a client will reach out to you or a potential client or reach out to you and they'll say hey I'm interested
in your services.
I need a pen test and I'll say OK let's let's talk about that you know and a lot of clients will want
you to before you meet sign a nondisclosure agreement.
So if they talk about anything specific to their network you can't just go out there and say hey X Y
Z about this client here's their network information you're prohibited from actually doing that.
So that will come either be tween the sales process or before the rules of engagement but usually comes
early on in the sales process and from there.
Once you have a nondisclosure agreement you sit down you talk scoping you you say hey like OK what what
IP addresses do I need to test.
What are the ranges how many of them.
What's your goal you know you have your sales meeting you talk about that when you talk about that you
are going to put together two items.
One is a master service agreement.
And the other is what is called a Statement of Work.
Now the master service agreement is a contractual document and basically it's going to specify your
performance objectives and kind of outline the responsibilities of both of the parties.
Now if you are curious to see what a nondisclosure agreement looks like or a master service agreement
or statement work you can Google a lot of these and here's an example.
I just went out to Google and said rapid 7 which is a pen testing company and said master service agreement.
And guess what rabbit seven actually has their master service agreement right here so you can click
on it you can read through it.
It's all legal mumbo jumbo type stuff right.
But you can read through this and see exactly what they specify.
Now the master service agreement is kind of like this blanket agreement that covers multiple contracts.
OK.
Now the Statement of Work is specific to a contract itself a single contract.
Now in the statement of work you're talking about activities deliverables timelines how much it's going
to pay.
It's a quote as well.
Right.
So you're going to say hey I'm going to perform let's just throw something out there a wireless penetration
test and we're going to do it by this deadline and we're going to deliver you a report when we're done.
And it's going to cost you this much money.
So if the client or potential client agrees to that.
They're going to sign that statement of work and they're going to sign that master service agreement.
Now in the sales process you might actually need a few more documentations or a few more documents.
One is sample report.
A lot of clients like to see a sample report.
I will show you one as well and you might need a recommendation letters.
OK.
If you're going on on the sales side most of this doesn't concern you but it's things that you should
still know about especially if you ever want to open your own business or start with.
But the what we're going to focus on and what I'm going to show you is the findings report.
So you're not going to have seen this but you should google some of these things and find out a little
bit more about them.
So before you test you are going to have what's called a rules of engagement.
So once we get the statement work sign the master service agreement sign everything up until that point
has been kind of ballpark.
So say there is an external pen test you're doing.
They might say I have one hundred IP addresses I need tested and you say OK you know you talk through
it you give them a quote you give him that statement at work they sign it everything's good and then
you have what is called a rules of engagement meeting.
Now the rules of engagement meaning will cover specifics of your testing.
So for example you have this one hundred IP addresses.
It'll say OK here are the exact IP addresses that you're going to be testing.
You're gonna have that in your rules of engagement.
And I like to call the rules of engagement a CIA or which is cover your you know what.
Cover your butt and you need this because it's going to say what you can and can't do what what can
you attack specifically the IP addresses.
What can you do what can't you do.
Usually what we cannot do is what's called denial of service right.
We cannot deny service.
Typically what we're testing against is in production.
We do not want to take down production for our client and a lot of the times we will not do social engineering
on engagements.
A lot of assessments have social engineering set aside as its own assessment.
So they typically leave those two out.
Almost always denial of service unless that's a specific thing they're wanting test it.
So you have this Rules of Engagement document you can not start your penetration test until that rules
of engagement is signed.
You absolutely cannot because that covers you in case of anything you say here is what you told me to
test.
Here's what I'm testing and here's what I am allowed to do.
So make sure you have a rules of engagement sign.
Now lastly and what's most important for you as a penetration tester is going to be the findings report.
So we're going to talk about the finders report.
It's going to detail what you found from a high level and a technical level.
And I'm going to be providing you with a sample report that you are free to use free to utilize et cetera.
We'll cover that in one video and then in a second video I'm going to show you how that report can be
taken and modified and I will show you what it looks like to have a real pen test report we'll review
a real pen test report and you can see what one actually looks like.
So let's go ahead and talk about pen test report writing and next video I'll catch you over there and
we'll look at it.