Pre-Attack Phase: Rules of Engagement

Question 1

Rules of engagement definition:

Answer 1

Rules of engagement (ROE) refers to the formal agreement and permission to perform a penetration test. ROE is a guideline for testers and as such should clearly state what is and isn’t allowed.

Simplified by Ermin:
Permission for you as a penetration tester to conduct a certain set of activities.

Don’t ever operate outside of the scope of your ROE w/out explicit permission.

Question 2

General notes:

Answer 2

• clients could require that you don’t perform specific forms of attack on their system (like a DDoS attack, if they’re worried that it could apply extra stress to their servers and disrupt their current service)