Expert Pentest Policy Guidelines

Writing a policy for an Expert Pentest is essential. Crafting a comprehensive policy helps ensure that it is conducted safely, legally, and ethically.

Creating a policy for an Expert Pentest is a critical step for several important reasons.

Establishing Ethical Guidelines: A policy establishes clear ethical guidelines for both the testers and the organization. It explicitly defines what behavior is acceptable during the pentest and what is strictly off-limits, promoting responsible and ethical testing practices.

Ensuring Consistency: A well-defined policy contributes to the consistent execution of Expert Pentests, standardizing the testing process and minimizing ambiguity.

Managing and Mitigating Risks: By outlining the scope, objectives, and limitations of the testing, the policy enables better risk management and mitigation, reducing the likelihood of unnecessary disruptions or damage to systems and data.

Defining Detailed Parameters: The policy conveys additional information about the pentest — assets to be tested, specific operations to be performed, limits hackers should adhere to (e.g., when to halt in the case of Remote Code Execution), and any tests excluded from scope (e.g., Denial of Service attacks).

Effective Communication: The policy ensures that everyone involved understands the pentest's purpose, its potential impact, and expected outcomes. It's where rules and expectations are set for all stakeholders — triagers, ethiackers, and organization members alike.

In essence, the policy reflects the client's intentions for the pentest and aligns all parties with a shared understanding of goals, ethical standards, and boundaries.

You can find a policy template when configuring an Expert Pentest. Alternatively, check out the examples below.

Examples

🎯 Main Goal

This section should outline the objective of the organization with the Expert Pentest. It helps researchers understand the organization's intent and the overall purpose of the pentest.

Example: The main purpose of this Expert Pentest is to secure our web application. We welcome ethical hackers to help us by responsibly reporting security weaknesses in our applications, services, and infrastructure.

🎯 Goals

The organization should define specific objectives they aim to achieve with the program. This helps align researchers with the company's priorities.

Examples:

• We encourage ethiackers to focus on identifying and reporting XSS vulnerabilities.
• We would like to know if there are any vulnerabilities related to roles on the application.

📜 Rules

This section establishes the boundaries for security testing, ensuring ethical behavior and compliance with legal considerations.

Examples:

Assets Rules:

• Specify whether production or staging environments can be tested.

Prohibited Actions:

• Denial of Service (DoS) attacks are out-of-scope.
• Social engineering attempts against employees or customers.
• Exploitation of vulnerabilities beyond proof-of-concept (PoC).

📝 Additional Notes

This section includes any other relevant information that may help ethiackers engage effectively with the program.

Examples: Usernames credentials for grey-box testing:

• User1
• User2

Note: Passwords sent by email.