The Importance of Staying Within Pen Test Scope

It is extremely important to establish pen test scope with your point of contact as a tester, from the point of view of ensuring a robust test methodology, as well as making sure the tester is operating within the confines of the law.

Whether assessing a web application for insecure code, or infrastructure for missing patches, there are a number of risks associated with testing beyond the agreed scope, and these can include severe legal consequences. Any access to or disruption of a computer system without the express permission of the owner could leave the tester vulnerable to prosecution under several pieces of legislation, including the Computer Misuse Act, the Human Rights Act, and the Data Protection Act. There are also potential reputational and professional consequences even in the event that a prosecution is not pursued, with a best-case scenario that a test that extends beyond scope includes a list of findings that are not of interest to the customer.

A number of tools can be employed with a view to operating within pen test scope. As a foundation, establishing a clear scope in writing with the customer is imperative, as is establishing any particularly sensitive targets in scope, or any critical systems specifically excluded from it.

The customer may request that critical systems, particularly those in production environments, are assessed for vulnerabilities, but that those vulnerabilities are not exploited, so as to minimise the potential for disruption, damage, or data loss. It may also be possible for the customer to apply network restrictions to the tester’s machine to limit network access, and to ensure that any accounts provided for the testing only provide access to the target systems.

Technical controls are also available that can help to ensure the tester remains in scope. These include use of a hosts list as a tooling input rather than free-text typing targets into a pen test distro. Using nmap with it ‘-il’ switch allows for a target list input, preventing any accidental wandering beyond defined scope. In general, copying and pasting targets from a scope document to the command window can help reduce the likelihood of manual error. In addition to this, the host firewall can be configured to prevent any communications from leaving the tester’s machine bound for any address outside of scope.

Regardless of the tooling or controls employed, keeping accurate records of every command executed provides the tester with robust evidence of their activities in the event of any issues arising during test. Armed with a full list of their actions, a tester can defend themselves against any false assertions of damage or disruption, as well as being able to demonstrate what actions were taken in the event a legitimate target is disrupted. This will enable the operations teams to return the system to service in the shortest possible time.

With the right mix of preparatory controls and permissions granted during the scoping stage, and technical controls to contain accesses, as well as mindfulness during test execution, the tester can be confident they are operating within the scope of testing, and thus with protection from any of the negative consequences that might otherwise accompany penetration test activities.

To find out how I can help your organisation protect itself against a constantly evolving threat landscape, contact me via YDC. Read more about my testing services here.