Scoping a Multi-Country External Test With Incomplete Asset Inventory
A global retailer requests an external penetration test before a peak sales event. The statement of work says "all internet-facing systems" and lists 500 public IP addresses from a spreadsheet compiled 11 months ago. The security manager says the spreadsheet is "mostly accurate" and that two recently acquired subsidiaries in Germany and Brazil may have their own IP ranges, but nobody has confirmed them. The test window is 10 business days, with a hard production change freeze from 1 November. The client wants phishing of 300 employees but has no signed social-engineering authorization and no process for handling compromised credentials. The procurement contract includes a standard "no service interruption" clause but no emergency contact list. The client also wants a report within three business days of test completion. The tester must deliver a plan in 48 hours.
1. Identify the three most significant scoping gaps and explain how each affects authorization or safety.
Read the worked answer
1. The asset inventory is stale and unverified. A spreadsheet from 11 months ago cannot establish current ownership, and 500 IPs may include addresses reassigned to other organizations. Testing them could affect third parties and exceed authorization.
2. The German and Brazilian subsidiaries create separate legal entities and jurisdictions. Without written authorization from each entity, the tester has no permission to test their ranges. A parent-company signature may not cover them.
3. The phishing request lacks signed social-engineering authorization and a credential-handling process. Phishing 300 employees can cause real credential compromise and HR or legal issues. Without approval, defined pretext boundaries, and a handling protocol, it is not safe or authorized.
Also material: no emergency contact list, an undefined 'service interruption', and a report deadline that may conflict with validation. The change freeze limits disruptive tests but does not remove the need for authorization. Each gap should be closed in the rules of engagement before any testing starts.
2. Draft the decisions you would put in the rules of engagement before testing starts.
Read the worked answer
Put in the rules of engagement: a validated in-scope IP list signed by the client; explicit exclusion of unconfirmed subsidiaries and any IP not confirmed in writing; the test window and blackout dates; emergency contacts and named stop authority; a definition of service interruption and a list of prohibited techniques; social-engineering authorization signed by an executive, with target list, pretext boundaries, credential capture and storage rules, and no password reuse; data handling and retention; third-party and SaaS exclusions; escalation paths; and the report timeline with a client review step.
Reasoning: the rules of engagement convert vague statement-of-work language into auditable permissions, protect third parties, and give both sides a clear way to stop. The client must confirm each subsidiary's authorization separately. If the client cannot do so before the window, those ranges are excluded and documented as a scope limitation. The phishing element should be removed from this engagement unless a signed authorization and handling process are in place. This is not bureaucracy; it is the mechanism that keeps the test lawful and safe.
3. How would you handle the client's insistence that the spreadsheet is 'mostly accurate' and that testing should start on time?
Read the worked answer
Do not start scanning unverified addresses just because the spreadsheet is 'mostly accurate'. Propose a phased plan: begin with a client-confirmed subset of IPs that the security manager can attest to in writing today, run low-impact discovery to validate ownership, and require the client to confirm any newly discovered ranges before testing. In parallel, ask the client to obtain written authorization from the German and Brazilian entities; if that cannot be done before the window, exclude them and state the limitation in the report. For phishing, either obtain signed authorization and a handling process or remove it from this engagement.
Explain the risk in business terms: scanning a reassigned IP could affect a customer or partner and create legal exposure; a production incident during peak sales would be worse than a delayed test. Offer a revised schedule with a prioritized set of confirmed assets and clear decision points. This is a scope decision, not a customer-service concession. Document the client's instruction and the tester's recommendation so the rationale is visible if the schedule slips.