Write rules of engagement somebody could work to

short · 35 min · Objective 5.5

Task

Write the rules of engagement for a test of your own lab, complete enough that a tester could work to them and a defender could deconflict against them. The missing clauses are the ones that cause the incidents.

Steps

  1. Write /tmp/roe.md for an assessment of your lab, covering: scope by address and by name, explicit out-of-scope items, the environment type (known, partially known or unknown) and why you chose it, the approach (offensive, defensive or an integrated purple team session), whether reconnaissance may be active or only passive, permitted and excluded techniques, testing windows, and data handling for anything extracted.
  2. Add the operational clauses that get forgotten: named contacts on both sides with out-of-hours numbers, what happens if the tester breaks something, what happens if the tester finds evidence of a REAL prior compromise, and how the tester's own traffic is deconflicted from a genuine incident.
  3. Add the authorisation statement: who is authorising, what they are authorising, and the fact that without it the activity is unauthorised access.
  4. Now write /tmp/roe-physical.md for a PHYSICAL test of the same premises, with the extra clauses it needs, particularly the authorisation letter the tester carries.
  5. Mark every clause that exists to protect the TESTER rather than the client. There are more than people expect.

Verify

python3 - <<'PY'
import re
t=open('/tmp/roe.md').read().lower()
need={'scope':'in scope|scope:','out of scope':'out.of.scope|excluded',
      'environment type':'known|partially known|unknown environment',
      'approach':'red team|blue team|purple|offensive|defensive',
      'reconnaissance':'passive|active recon',
      'windows':'window|hours of',
      'contacts':'contact|escalation',
      'prior compromise':'prior compromise|existing compromise|real intrusion',
      'deconfliction':'deconflict|distinguish|our traffic',
      'authorisation':'authoris|authoriz'}
missing=[k for k,p in need.items() if not re.search(p,t)]
print('clauses present:',len(need)-len(missing),'of',len(need))
assert not missing, 'missing: '+', '.join(missing)
PY
grep -ciE "letter|carry|physical" /tmp/roe-physical.md

The two clauses people omit are the prior-compromise clause and deconfliction, and both are asserted here. Finding a real intrusion mid-test is not hypothetical, and a tester with no instruction about it either says nothing or tells the wrong person. Deconfliction matters the other way: without it the client's own team spends the week investigating the tester.

Notes

The clauses protecting the tester are the ones worth counting. Written authorisation, a named authoriser with the standing to grant it, scope boundaries, and for physical testing a letter to hand to whoever detains you. Without those, the difference between an assessment and an offence is somebody's recollection of a conversation.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.