1.3 Planning & Scoping

Question 1

What do organizations require from the Pentest teams in order to assure they have a good reputation?

Answer 1

-Provided credentials, such as certifications that prove they have the appropriate skills to conduct a PenTest.
-Recent background checks, that can include credit scores and driving records - making sure no one has a criminal record or felony conviction.

Question 2

How should you limit invasiveness based on scope?

Answer 2

By defining acceptable actions, such as social engineering and physical security tasks. If planning an invasive attack, such as a Denial of Service (DoS) attack, restrictions that might impact fragile systems should be defined.