Write rules of engagement somebody could work to

short · 35 min · Objective 5.5

Task

Write the rules of engagement for a test of your own lab, complete enough that a tester could work to them and a defender could deconflict against them. The missing clauses are the ones that cause the incidents.

Steps

  1. Write /tmp/roe.md for an assessment of your lab, covering: scope by address and by name, explicit out-of-scope items, the environment type (known, partially known or unknown), permitted techniques, excluded techniques, testing windows, and data handling for anything extracted.
  2. Add the operational clauses that get forgotten: named contacts on both sides with out-of-hours numbers, what happens if the tester breaks something, what happens if the tester finds evidence of a REAL prior compromise, and how the tester's own traffic is deconflicted from a genuine incident.
  3. Add the authorisation statement: who is authorising, what they are authorising, and the fact that without it the activity is unauthorised access.
  4. Now write the same document for a PHYSICAL test, and note the extra clauses it needs — particularly a get-out-of-jail letter the tester carries.
  5. Mark every clause that exists to protect the TESTER rather than the client. There are more than people expect.

Verify

python3 - <<'PY'
import re
t=open('/tmp/roe.md').read().lower()
need={'scope':'in scope|scope:','out of scope':'out.of.scope|excluded',
      'environment type':'known|partially known|unknown environment',
      'windows':'window|hours of',
      'contacts':'contact|escalation',
      'prior compromise':'prior compromise|existing compromise|real intrusion',
      'deconfliction':'deconflict|distinguish|our traffic',
      'authorisation':'authoris|authoriz'}
missing=[k for k,p in need.items() if not re.search(p,t)]
print('clauses present:',len(need)-len(missing),'of',len(need))
assert not missing, 'missing: '+', '.join(missing)
PY
grep -ciE "letter|carry|physical" /tmp/roe-physical.md

The two clauses people omit are the prior-compromise clause and deconfliction, and both are asserted here. Finding a real intrusion mid-test is not hypothetical, and a tester with no instruction about it either says nothing or tells the wrong person. Deconfliction matters the other way: without it the client's own team spends the week investigating the tester.

Notes

The clauses protecting the tester are the ones worth counting. Written authorisation, a named authoriser with the standing to grant it, scope boundaries, and — for physical testing — a letter to hand to whoever detains you. Without those, the difference between an assessment and an offence is somebody's recollection of a conversation.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.