Legal / Authorisation

# RULES OF ENGAGEMENT (RoE) — TEMPLATE + DEFENSIVE CHECKLIST
# Use this for authorised engagements only. No real customer data, no destructive techniques,
# no detection evasion against systems you do not own. If anything below is unclear, STOP and
# escalate before any testing begins.

# ===== 1. Parties + authorisation =====
# - Client (legal name + ABN/Company number)
# - Engagement lead (client side) + technical contact
# - Testing organisation + lead tester
# - Authorisation chain: signed letter of authorisation (LOA) from someone with authority to grant it
# - Sub-contractors? Listed by name; LOA covers them.

# ===== 2. Scope =====
# IN scope:
#   - Targets (domains, IPs, mobile apps, source repositories)
#   - Environment (staging, pre-prod, prod with limits)
#   - Test windows (date ranges + time of day, timezone)
# OUT of scope:
#   - Anything not explicitly listed
#   - 3rd-party services even if reachable
#   - Customer accounts; only test accounts seeded by the client

# Document the scope as a TABLE; ambiguity is where incidents happen.

# ===== 3. Allowed techniques =====
# - Authenticated + unauthenticated web testing
# - Network scanning (specify rates)
# - Application + API fuzzing
# - Social engineering: only if explicitly listed, with target groups + script
# - Physical: only if listed, with site contacts + carry-letter

# ===== 4. Disallowed by default =====
# - Denial of service / volumetric load tests
# - Destructive actions (deletion, corruption, ransomware simulation)
# - Mass exploitation that spreads beyond the in-scope hosts
# - Live customer data exposure
# - Detection evasion against systems you do not own
# - Testing outside the agreed window

# ===== 5. Data handling =====
# - Test data only; synthetic or scrubbed copies of prod
# - Findings + artefacts encrypted at rest, in transit
# - Retention: deleted within N days after the report is delivered
# - Sub-processors: same controls

# ===== 6. Communication + incident protocol =====
# - Daily status update channel (Slack / Teams / email)
# - Find a critical (P0 / P1) -> notify within 1 business hour
# - SOC contact for accidental alerts; share tester IPs in advance so genuine alerts stand out
# - 'Stop test' phrase: a code word that immediately pauses all testing

# ===== 7. Evidence + reporting =====
# - Timestamps (ISO 8601 in UTC)
# - Source IP + test account + tooling + payloads
# - Screenshots / packet captures, with PII redacted
# - Severity scored (CVSS or client framework)
# - Remediation guidance + verification steps

# ===== 8. Post-engagement =====
# - Findings shared via encrypted channel
# - Verification window for client to test fixes
# - Final report; raw artefacts retained per policy then destroyed
# - Lessons learned: anything to add to next RoE

# ===== Defensive checklist (turn the engagement into hardening) =====
# For every finding:
#   - Reproduction steps (lab only)
#   - Detection rule (Sigma / Wazuh / EDR)
#   - Hardening control (config, code, policy)
#   - Severity + owner + due date
#   - Verification: how the client tests the fix is effective

# ===== Pre-engagement self-check =====
# - [ ] Signed LOA from authorised signatory
# - [ ] Scope table written down + agreed
# - [ ] Test windows + timezone + holidays handled
# - [ ] Allowed + disallowed techniques explicit
# - [ ] Data handling agreed
# - [ ] Communication channels live before day 1
# - [ ] SOC notified; tester IPs shared
# - [ ] 'Stop test' phrase agreed
# - [ ] Reporting template aligned
# - [ ] Evidence storage + retention policy agreed

# ===== Patterns to internalise =====
# - No RoE -> no test. Period.
# - Write the report headers BEFORE testing; that exposes scope gaps early
# - Every offensive note pairs with a detection rule + hardening control
# - Authorisation stands for the scope specified, not beyond
# - Document deviations in real time; do not assume verbal scope changes survive

# ===== Pitfalls =====
# - Verbal scope expansions ('also check this subdomain') -> always confirm in writing
# - Testing the production database before backup integrity is verified
# - Phishing simulations against employees who haven't been trained to spot or report them
# - Sharing findings publicly without redaction + client approval
# - Letting the engagement drift into Disallowed techniques during an exciting lead

# Before any test, get:
#   - Signed Rules of Engagement (RoE)
#   - Authorised contacts + escalation path
#   - Scope (IPs, domains, accounts, time windows, allowed techniques)
#   - Data handling rules (PII, regulated data — usually "don't touch")
#   - A "stop on incident" clause