|
When attempting to determine the labor and skills needed to "scope" a project we have to ask a summary of questions to determine the size and labor required for the project.
Below are some of the most common questions associated with providing you with proposal for assessment services work. Additional questions maybe required so that we can provide a complete Master Services Agreement (MSA) and Work Order (WO) for the desired outcome. |
|
External Penetration Testing
Internal Penetration Testing
We need to determine size of the internal environment across all offices, datacenters, cloud infrastructure. Approximate number of network-connected systems including, endpoints, servers, infrastructure. Approximate numbers are ok - 100, 250, 500, 2000 etc. Number of employees is also helpful.
Social Engineering Campaign
We typically test using single scenario email-based social engineering campaign to impersonate business partner or service provider. Goal is to test click rates and entice users to reveal their credentials or authorize application access (OAuth attacks). Singe scenarios are typically not effective against entire company so they should be targeted against specific groups or high value targets. We can also perform multi scenario campaigns against different departments.
Web Application Assessment
Mobile Application Assessment
Please provide brief description of the application functionality - what is the core functionality, who the users are what capabilities exist for these users.
Web Application Assessment with Mobile App
AWS Configuration Review:
These questions only apply to AWS config review with R/O admin privileges given. For external pen test or web application testing in AWS standard pen test webapp questions apply.
Azure/Microsoft365 Configuration Review:
These questions only apply to Azure/Microsoft365 config review with R/O admin privileges given.
1.How many Azure/Microsoft365 tenants are in scope?
2.Please provide type and approximate amount of Azure/Microsoft licenses in use within each tenant.
3.Apart from Azure AD, is there any infrastructure in use within Azure tenant? If so, please provide details.
Wireless Assessment:
Provide listing of all physical locations that are in scope for the wireless physical test. For each location please include:
- Please provide approximate number of active hosts/IPs exposed to the internet across office, datacenter and cloud infrastructure.
- Are there any day/time restrictions for the testing?
- We normally provide a single report with executive summary and technical details as well as third party attestation. Do you have any additional reporting requirements for this project?
- Are there any specific deadlines for project execution and report delivery?
Internal Penetration Testing
We need to determine size of the internal environment across all offices, datacenters, cloud infrastructure. Approximate number of network-connected systems including, endpoints, servers, infrastructure. Approximate numbers are ok - 100, 250, 500, 2000 etc. Number of employees is also helpful.
- Are there any time/day restrictions for the testing to be deliverd?
- We normally provide a single report with executive summary and technical details as well as third party attestation. Do you have any additional reporting requirements for this project?
- Our standard engagement is performed remotely via CT supplied virtual machine or hardware. Please specify if onsite presence is a requirement for this project.
- Are there any specific deadlines for project execution and report delivery?
Social Engineering Campaign
We typically test using single scenario email-based social engineering campaign to impersonate business partner or service provider. Goal is to test click rates and entice users to reveal their credentials or authorize application access (OAuth attacks). Singe scenarios are typically not effective against entire company so they should be targeted against specific groups or high value targets. We can also perform multi scenario campaigns against different departments.
- Please provide approximate user count that would be part of the campaign(s).
- Would like to use multiple types of campaigns for different departments?
- Would you like to include a phone-biased social engineering campaign?
- Would you like us to do target discovery or target list will be provided?
Web Application Assessment
- Please provide name and if available the URL of the application.
- Please provide brief description of the application functionality - what is the core functionality, who the users are what capabilities exist for these users.
- Approximate number of user input pages.
- How many different user type profiles exist within the application? (standard user, client admin, site admin etc.).
- Are there any publicly facing APIs, if so, can you provide API documentation? If not available, then approximate number of API endpoints.
- Are there any day/time restrictions for the testing?
- Can access be provided to the application source code and/or logs? While not required, access to code and logs can improve coverage and accuracy of the assessment.
- We normally provide a single report with executive summary and technical details as well as third party attestation. Do you have any additional reporting requirements for this project?
- Does this application require a OWASP ASVS Cloud Application Security Assessment
- Are there any specific deadlines for project execution and report delivery?
Mobile Application Assessment
Please provide brief description of the application functionality - what is the core functionality, who the users are what capabilities exist for these users.
- How many different user type profiles exist within the application? (standard user, client admin, site admin etc.).
- Public API information – application API documentation mobile app uses if available or number of API endpoints.
- What is the mobile application platform IOS and/or Android?
- Does application use certificate pinning? If so, can a debug build be provided to allow for data transmission analysis?
- Can you provide application build outside of native app store? (APK/IPA application file for Android and IPA build for x86 IOS simulator)
- Are there any specific deadlines for project execution and report delivery?
Web Application Assessment with Mobile App
- Please provide name and if available the URL of the application.
- Please provide brief description of the application functionality - what is the core functionality, who the users are what capabilities exist for these users.
- Approximate number of user input pages.
- How many different user type profiles exist within the application? (standard user, client admin, site admin etc.).
- Are there any publicly facing APIs, if so, can you provide API documentation? If not available, then approximate number of API endpoints.
- Are there any day/time restrictions for the testing?
- Can access be provided to the application source code and/or logs? While not required, access to code and logs can improve coverage and accuracy of the assessment.
- What is the mobile application platform IOS and/or Android?
- Does application use certificate pinning? If so, can debug build be provided to allow for data transmission analysis?
- Can you provide application build outside of native app store? (APK/IPA application file for Android and IPA build for x86 IOS simulator)
- We normally provide a single report with executive summary and technical details as well as third party attestation. Do you have any additional reporting requirements for this project?
- Are there any specific deadlines for project execution and report delivery?
AWS Configuration Review:
These questions only apply to AWS config review with R/O admin privileges given. For external pen test or web application testing in AWS standard pen test webapp questions apply.
- How many AWS accounts are in scope?
- Are you using AWS ORGs or is there any other way these accounts are centrally managed?
- Approximately how many EC2 instances within each tenant?
- How many IAM roles exist across all accounts?
- How many VPCs within each tenant
- Approximately how many custom IAM roles are in scope?
- How many public facing IPs
- Are you utilizing AWS API Gateway, Lambda, Cognito, ECS, or any other AWS "serverless"/API offering?
- Are there any RDS instances (AWS managed database)?
- Are there any specific deadlines for project execution and report delivery?
Azure/Microsoft365 Configuration Review:
These questions only apply to Azure/Microsoft365 config review with R/O admin privileges given.
1.How many Azure/Microsoft365 tenants are in scope?
2.Please provide type and approximate amount of Azure/Microsoft licenses in use within each tenant.
3.Apart from Azure AD, is there any infrastructure in use within Azure tenant? If so, please provide details.
- Are there any specific deadlines for project execution and report delivery?
Wireless Assessment:
Provide listing of all physical locations that are in scope for the wireless physical test. For each location please include:
- Address or city, state.
- Type (office building, factory, campus, plant)
- approximate size in sqft, number of floors etc.
- approximate number of employees at the location.
- number of SSIDs at the location
