Scope, rules of engagement and the law
You put a security assessment on paper before it starts: you pick its type, draw the scope and limits, write the rules of engagement and get to know computer-misuse and data-protection laws around the world.
Level 201 · 22 lessons · 18 practice labs
Lessons
Why written rules
- What separates an assessment from an attack: permission and purpose
- Stakeholders: sponsor, system owner, assessment team and emergency contact
- Assessment types: external, internal, web, wireless and configuration review
- Black, grey and white box: how much you know at the start
- Short task: choose the right assessment type for three fictional requests
Defining the scope
- Assets in scope: IP ranges, domains and applications
- Out of scope: third-party services and shared hosting
- Testing permission policies of cloud and hosting providers
- Testing windows, intensity limits and the risk of disruption
- The scoping questionnaire and effort estimate
- Short task: prepare a scope document for the fictional Mavikaya Logistics
Rules of engagement
- The rules of engagement document: what is allowed, what is not, and communication
- Stop conditions: a critical finding, an outage and unexpected data
- Protecting and destroying data met during testing
- Communication plan: daily status, emergency line and escalation
- Short task: find five gaps in a rules of engagement document
Law and ethics: examples from around the world
- Computer misuse laws: how countries define unauthorised access
- The Budapest Convention: a shared international framework
- Data-protection laws and privacy during testing: GDPR, KVKK and others
- Contracts, non-disclosure agreements and limits of liability
- Professional ethics and responsible disclosure
- Capstone: prepare the scope, rules and authorisation pack for an assessment
Practice labs
- Match an assessment's stakeholders to their roles: Identify the sponsor, system owner, assessment team and emergency contact from Pusulaya Sigorta's emails and build a contact table.
- Choose the right assessment type for three requests: Pick external, internal, web, wireless or configuration review for each fictional request and write your reasoning.
- Justify a black, grey or white box choice by cost and coverage: Read Lodoskaya Denizcilik's budget and goals, choose the knowledge level and explain the lost coverage and time impact on one page.
- List in-scope assets as addresses, domains and applications: Extract in-scope IP ranges, domains and applications from Mavikaya Lojistik's request and build a scope table.
- Find and remove third-party assets from the scope list: Review the lab DNS records and ownership notes and move entries belonging to shared hosting and outside services out of scope.
- Turn a scoping questionnaire into an effort and window estimate: From the filled questionnaire's asset counts and rate limits, estimate effort in days and propose test windows by outage risk.
- Find the five gaps in this rules-of-engagement document: Compare Ayçiçeği Gıda's draft rules of engagement with a checklist and list the missing permission, prohibition and contact items.
- Write the stop conditions for an assessment: Define who does what and how fast for a critical finding, an outage or unexpected data during the Bakırdere Madencilik assessment.
- Prepare a communication plan with daily status and escalation: Write a communication plan for a five-day assessment with a daily report template, emergency line and escalation chain.
- Classify data met during testing and choose the right handling: Classify five sample files seen on a lab share as personal, confidential or public and write the handling for each.
- Store assessment evidence encrypted with restricted access: Move the lab evidence folder into an encrypted archive, show it opens only with the team key and keep an access record.
- Destroy data at the end of testing and write a destruction record: At the end of the assessment, find all copies of lab evidence, delete them securely, verify the deletion and prepare a record for sign-off.
- Decide whether five actions are authorised assessment or unauthorised access: Judge five short cases against written permission and scope and give examples of how different countries' laws would treat them.
- Map personal data obligations during an assessment: In the Lavinya Klinikleri scenario, map obligations from laws such as GDPR and KVKK to the test steps in a table.
- Draft a responsible disclosure for a flaw noticed outside scope: Prepare a notice reporting an issue noticed in a third-party service during the assessment through the right channel, without testing it.
- Check the assessment clauses in a contract and NDA: Mark whether liability limits, confidentiality and data return clauses exist in the draft contract and list the gaps.
- Check provider test permission for cloud-hosted assets: Read the fictional provider policy for in-scope cloud assets and record the test types that need approval or are forbidden in the scope document.
- Assemble a complete scope, rules and authorisation pack: Prepare the scope document, rules of engagement and signature page for Selvikent Belediyesi and verify completeness with a checklist.
About this course
You put a security assessment on paper before it starts: you pick its type, draw the scope and limits, write the rules of engagement and get to know computer-misuse and data-protection laws around the world.
What you will learn
- Why written rules
- Defining the scope
- Rules of engagement
- Law and ethics: examples from around the world
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.