Write rules of engagement somebody could work to

short · 35 min · Objective 5.5

Task

Write the rules of engagement for a test of your own lab, complete enough that a tester could work to them and a defender could deconflict against them. The missing clauses are the ones that cause the incidents.

Steps

  1. Write /tmp/roe.md for an assessment of your lab, covering: scope by address and by name, explicit out-of-scope items, the environment type (known, partially known or unknown), permitted techniques, excluded techniques, testing windows, and data handling for anything extracted.
  2. Add the operational clauses that get forgotten: named contacts on both sides with out-of-hours numbers, what happens if the tester breaks something, what happens if the tester finds evidence of a REAL prior compromise, and how the tester's own traffic is deconflicted from a genuine incident.
  3. Add the authorisation statement: who is authorising, what they are authorising, and the fact that without it the activity is unauthorised access.
  4. Now write the same document for a PHYSICAL test, and note the extra clauses it needs — particularly a get-out-of-jail letter the tester carries.
  5. Mark every clause that exists to protect the TESTER rather than the client. There are more than people expect.

Files the Verify reads

The Verify block reads these by name, so save them exactly here:

  • /tmp/roe-physical.md -- the rules of engagement for the physical part of the test, including the authorisation letter the tester carries.

Verify

python3 - <<'PY'
import re
t=open('/tmp/roe.md').read().lower()
need={'scope':'in scope|scope:','out of scope':'out.of.scope|excluded',
      'environment type':'known|partially known|unknown environment',
      'windows':'window|hours of',
      'contacts':'contact|escalation',
      'prior compromise':'prior compromise|existing compromise|real intrusion',
      'deconfliction':'deconflict|distinguish|our traffic',
      'authorisation':'authoris|authoriz'}
missing=[k for k,p in need.items() if not re.search(p,t)]
print('clauses present:',len(need)-len(missing),'of',len(need))
assert not missing, 'missing: '+', '.join(missing)
PY
grep -ciE "letter|carry|physical" /tmp/roe-physical.md

The two clauses people omit are the prior-compromise clause and deconfliction, and both are asserted here. Finding a real intrusion mid-test is not hypothetical, and a tester with no instruction about it either says nothing or tells the wrong person. Deconfliction matters the other way: without it the client's own team spends the week investigating the tester.

Notes

The clauses protecting the tester are the ones worth counting. Written authorisation, a named authoriser with the standing to grant it, scope boundaries, and — for physical testing — a letter to hand to whoever detains you. Without those, the difference between an assessment and an offence is somebody's recollection of a conversation.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.