The Verbal Scope Expansion
Your firm has a signed statement of work (SOW) with Northwind Logistics covering two things: the external range 203.0.113.0/28 and the HQ internal subnet 10.20.0.0/24. Testing is authorized 20:00–05:00 local for five nights, and the SOW requires notification of the client's security team within four hours of any critical finding. The authorized signatory is the CISO, who is on leave with no delegate named; the escalation appendix lists only her desk and mobile numbers.
On night two, the IT operations manager - helpful, senior, but not a signatory - calls and asks you to "just take a quick look" at the new warehouse network, 198.51.100.0/24, because it rides the same MPLS circuit. That same night you confirm an unauthenticated administrative console on an in-scope external host, and reverse DNS on the external range resolves several addresses to Northwind's German subsidiary, a legal entity the SOW never mentions.
1. The IT operations manager asks you to scan 198.51.100.0/24 tonight. What is your response, and what must happen before any packet is sent to that range?
Read the worked answer
Decline, and put the decline in writing. Authorization flows only from the party that signed the SOW - here, the CISO. A senior employee's verbal request is not scope; it is precisely the fact pattern that converts an authorized assessment into unauthorized access under the CFAA or Computer Misuse Act, and it likely voids professional liability coverage for that work.
Before touching the range:
- Request a written amendment or change order signed by the CISO, or by a delegate whose authority is documented, naming the range, the testing window, the technical contact, and the data classes present.
- Confirm the range is genuinely Northwind-owned. An MPLS circuit routinely carries partner or subsidiary traffic, and reachability is not ownership.
- Re-price and re-schedule. Added scope consumes days already committed to the five-night budget.
Log the call - time, name, exact wording - in the engagement journal, and route any pushback to your engagement manager. Urgency does not convert into implied consent.
2. At 02:10 on night two you confirm the unauthenticated admin console and the four-hour notification window is running. The CISO is unreachable. What do you do?
Read the worked answer
The notification obligation exists independently of authorization, so treat it as a deadline, not a courtesy.
Steps, in order:
- Attempt the CISO's mobile and desk lines, logging each attempt with a timestamp.
- Contact the next name in the escalation appendix. Notification is not authorization - briefing the operations manager so the client can act on an exposed console does not expand your scope.
- Disclose minimally: host, nature of exposure, business risk, and the recommended action. Do not send exploit detail or credentials over an unverified channel.
- If nobody acknowledges by the deadline, escalate internally to the engagement partner to reach the client's executive sponsor, and send written notice to the contractual notice address so a record exists.
The reasoning: the exposure may be under active exploitation, and the four-hour clause exists so the client can respond. "The contact was on leave" is not a defense; an unbroken chain of documented attempts is.
3. Several in-range IPs resolve to the German subsidiary. How do you treat them, and what do you need before testing?
Read the worked answer
Reverse DNS is a naming artifact, not proof of ownership or authority. Three explanations fit: a geo-IP/PTR artifact, hosts owned by a legally separate affiliate, or shared hosting.
Until the client confirms ownership in writing, treat those hosts as out of scope even though the IP sits inside 203.0.113.0/28. An in-scope IP address does not confer authority over a system or its data if a different legal entity owns it.
The assessment should state the distinction explicitly: scope by address, scope by asset owner, and scope by data controller are three different things. The German entity also raises GDPR questions - testing systems processing EU personal data may need the affiliate's consent and processor terms, which Northwind, not you, must obtain.
Practical output: document the resolution results, ask the client to either obtain affiliate consent or formally exclude those hosts, and report the finding at the level of detail you already have rather than probing to enrich it.