Comment gérez-vous les attentes des clients lors d’une mission de test d’intrusion ?

Set clear expectations with your client for a smooth penetration testing journey. Define the scope, objectives, and timeline upfront. Discuss potential risks and legal considerations openly. Keep them in the loop with regular updates, and educate them on the process. Collaborate on findings and remediation plans. After testing, provide a thorough debriefing, and offer post-engagement support. Transparent communication ensures a successful and mutually beneficial engagement.

Every customer's environment is unique, and needs will be different; but managing their expectations begins with understanding their current policies and frameworks they follow. I explain that the pen test gives us a sample report of where we are at with risk management and how it will help us identify how we can help the customer fill in the gaps afterwords (what's missing from practice or what can/should be improved right away). Provide the findings to the client, identify what needs to be prioritized, and follow up to ensure there's a plan for customer deliverables to be met.

Define the scope and objectives Establish the rules of engagement Communicate the methodology and deliverables Provide regular updates and feedback Deliver a comprehensive report and presentation Follow up and maintain relationship Here’s what else to consider

Absolutely, here's a concise breakdown: Clear Communication: Understand client goals and define the scope clearly. Documentation: Detailed SoW outlining objectives, methods, and limitations. Regular Updates: Keep the client informed of progress. Risk Assessment: Categorize and prioritize findings. Post-Engagement: Debrief, deliver a comprehensive report, offer recommendations. Educational Approach: Explain findings and offer training opportunities. Flexibility: Be adaptable to scope changes and unexpected findings. Professionalism: Maintain a respectful and responsive attitude. Follow-up Support: Offer assistance post-report delivery.

Relationship and Rapport. Absolutely define scope, set expectations. What we have found is some clients will say they want a full engagement, but when we start getting detailed they will pull back and say 'well let's not go quite that far...' Sometimes you have to listen to the subtext of the answer.

One thing I have found helpful is being able get the client a report that can easily help address vulnerabilities and make decisions with a report that is very easy to understand and use. I usually leverage a lot of visuals in reports to help them quickly identify systems to focus on for remediation.

Certainly, here's a condensed version: Scope Definition: Clearly define what's included and excluded. Authorized Activities: Specify allowed actions and tools. Legal Compliance: Ensure adherence to laws and policies. Communication Protocols: Define reporting and updates. Data Handling Rules: Establish data protection protocols. Timeline and Schedule: Set clear engagement timelines. Escalation Procedures: Outline critical issue escalation. Roles and Responsibilities: Define involved parties' duties. Confidentiality: Stress confidentiality and non-disclosure. Exit Strategy: Plan for conclusion and post-assessment support. Contingency Plans: Prepare for unforeseen situations.

Methodology Communication: Approach Overview: Summarize the testing approach. Detailed Steps: Outline specific testing techniques. Risk Assessment: Explain how risks will be evaluated. Compliance Alignment: Highlight industry standards compliance. Deliverables Communication: Report Structure: Explain report sections and summaries. Findings Documentation: Detail identified issues. Severity Classification: Define risk severity levels. Recommendations: Present actionable mitigation steps. Presentation/Debrief: Offer explanation sessions. Post-Assessment Support: Specify ongoing support.

Explain the testing methodology that will be used, including the tools and techniques involved. Clearly outline the expected deliverables, such as interim reports, a final report, and any presentations. Ensure the client understands what to expect at each stage of the process.

Scheduled Reports: Regularly share progress and findings. Highlight Key Points: Emphasize significant discoveries. Risks and Actions: Communicate risks and mitigation steps. Adherence to Timeline: Confirm project progress. Feedback Mechanisms: Open Channels: Encourage feedback through various avenues. Structured Sessions: Arrange formal feedback sessions. Act on Feedback: Implement actionable suggestions. Continuous Improvement: Use feedback for future enhancements. Efficient Communication: Conciseness: Keep updates focused and brief. Documentation: Use reports, emails, or presentations. Prompt Responses: Address urgent matters promptly. Acknowledgment: Recognize and respond to feedback.

Key element. Otherwise what's the point of it for the customer. If they've brought in an 'expert' to help then the advise afterwards is critical to moving forward.

Upon completion of the testing, provide a detailed report that includes an executive summary, findings, vulnerabilities discovered, risk ratings, and recommended remediation actions. Follow this up with a presentation to discuss the findings, answer questions, and ensure the client fully understands the results.

This is where the long term relationship builds from. There's a difference between transactional service delivery and contractual service delivery. Needless to say contractual builds over time. If you do it right.

A well-known example is the penetration test conducted on the Maroochy Water Services in Australia. This case highlighted the importance of clear communication between the testing team and the client, especially regarding the potential impacts and vulnerabilities found. The testers discovered critical vulnerabilities in the SCADA system, leading to significant improvements in the system's security. This case underscores the importance of thorough testing and clear, detailed reporting to the client about the vulnerabilities and recommended actions.

Make sure the client understands that a well-done pentest does not necessarily equal to a list of critical findings. Be transparent about the scope, methodology, time constraints, and deliverables, and provide visibility about what was not tested.