Question

Shaun is an external penetration testing consultant. the chief information security officer (ciso) of the organization he is working with indicated that none of the internal higher management executives should receive any kind of spear-phishing emails during shaun's testing. which part of the rules of engagement would cover this limitation?

a. authorization
b. other boundaries
c. initiation
d. target locations

Answer 1

Shaun's limitation on not sending spear-phishing emails to internal higher management during penetration testing is covered under the 'Other Boundaries' section of the rules of engagement. This section details the scope, approach, and specific limitations of the security tests to be conducted, ensuring they are carried out ethically and legally.

"The correct option is approximately option B"

Step-by-step explanation:

Shaun is an external penetration testing consultant and has been set specific conditions by the Chief Information Security Officer (CISO) of the organization he's working for. The restriction on spear-phishing emails directed at internal higher management executives during testing is a type of limitation typically covered under the 'Other Boundaries' section of the rules of engagement in penetration testing.

The rules of engagement (RoE) for penetration testing are critical as they define the scope, approach, and limitations of the security testing to be conducted. Specifically, the 'Other Boundaries' section can set guidelines on what activities are permitted, such as limitations on social engineering attempts which would include spear-phishing targeted at certain individuals, departments, or roles.

To ensure that these rules are adhered to, Shaun would need to receive clear authorization detailing out the RoE with these limitations. Any violation of the 'Other Boundaries' could lead to ethical breaches and legal repercussions, highlighting the importance of these limitations in maintaining the professionalism and legality of the testing process.