- It goes without saying,
you have to be very aware of the different
legal concepts of penetration testing.
You have to be aware of local laws and,
you know different type of regulations and so on.
And this is because some of the activities
in the penetration test
might violate some local laws
depending on where geographically
you are doing this test.
For example,
if you actually collect packet captures
or obtain information from a voiceover AP system
or voicemails doing the penetration test,
that action can be considered
wire tapping in some countries.
In addition to local laws,
you will be responsible for creating
certain legal documents like contracts,
statement of works or SOWs,
Master Service Agreements or MSAs,
Non-Disclosure Agreements or NDAs.
Now, if you work for a large company
and you're a consultant doing business
for that company to another client,
most definitely their legal department
will actually take care of a lot of the things
that we're gonna be highlighting here.
Right?
But for the purpose of the exam
you have to understand these concepts
especially the contract,
the statement of works,
the master service agreements
and the non disclosure agreements.
So starting with the contracts.
The contract is actually
of course, you know,
goes without saying also,
is one of the most important documents in your engagement.
It's actually specifying the terms of the agreement.
How will you get paid?
and a clear documentation of the services
that will be performed.
The document should be very specific.
It should be easy to understand.
And without any ambiguities, right?
Ambiguities will likely lead into customer dissatisfaction
or friction between you and your customer.
Legal advice by a lawyer
is always recommended for a contract, right?
So if you are brand new into pen testing
and you're doing this in your own,
I will definitely advise you to go ahead
and get legal advice by a lawyer.
Now, I mentioned the statement of work earlier
and basically what that is,
is a document that specifies
the activities to be performed
during the penetration testing engagement.
It can be used to define some of the,
you know,
most key elements of the penetration testing engagement
like, you know,
the project timeline
or the penetration testing timeline,
including the report.
A delivery schedule,
the scope of the work to be performed.
One of the most crucial items of course
of the pre-engagement tasks,
the location of the work
the special technical and non technical requirements
the payment schedule and so on.
Right? So we also mentioned
the rules of engagement document earlier.
It includes, you know, some of these elements,
in some cases actually they can be combined.
You may have actually a master contract
that will include the, you know
basically the SOW, the main contract
and the rules of engagement
but in most cases actually are separate documents.
Now, another legal aspect
of a penetration testing engagement
against the concept is Export Control.
You always have to become aware
of any export control restriction that may be present
in the country where the penetration testing
will be performed, especially if you're actually working
for a multinational company,
that they may actually fly you
to different places around the world.
There may be tools, software, hardware that cannot
be exported or imported to that country.
And these include certain cryptographic software,
encryption technologies.
And for several years,
more than 40 countries actually have been
trying to negotiate this type of export controls under
an arrangement called The Wassenaar Arrangement.
And basically that was an arrangement
was established for export control
for conversional arms
and the dual use of goods and technologies.
Right? And now for many, many years,
they actually have been also trying
to consider security tools
and software, power
and specifically things that can be used
for penetration testing and ethical hacking
or you know
real life hacking to be considered
as arms and could be controlled
by those certain national laws in different countries.
So you have to be very aware of that.
Now your customer may have specific corporate policies
that need to be taken into consideration
whenever you perform a penetration testing as well.
In most cases, the customer will initially
disclose any items with their corporate policy,
statements that may actually have a direct impact
of the penetration testing engagement
but you have to always ask, right?
Always be sure and clearly document
if there are actually any of those policies in place.
Some companies may also be
under a specific regulation when they actually
have to create a vulnerability
and a penetration testing policy within their organization.
They might specify restricted
and non-restricted systems and information
on how the penetration testing should be conducted according
to a regulatory standard as well.
So all those are a lot of different legal aspects
of penetration testing that many people actually
do not know that assist and that you should take
into consideration in your company or in your engagement.