A client requests a penetration test of their environment but insists that only two IT administrators know about the test. The security operations center (SOC) is not informed. During the test, the SOC detects the activity and begins an incident response, quarantining the tester's machine. Which pre-engagement planning step would have BEST prevented this operational conflict?

Question

Accepted Answer

B. Defining a deconfliction process in the rules of engagement. A deconfliction process, documented in the rules of engagement, establishes a communication channel and contact list that allows the penetration testing team to verify their activity with security operations if detected, and vice versa. This prevents the SOC from treating authorized test traffic as a real incident and avoids wasted incident response resources.

Related Questions

Discussion