2KKUU7ita

Timing
Chapter 3: Developing Your Ethical Hacking Plan
They say that it’s “all in the timing.” This is especially true when performing
ethical hacking tests. Make sure that the tests you perform minimize disruption
to business processes, information systems, and people. You want to
avoid harmful situations such as miscommunicating the timing of tests and
causing a DoS attack against a high-traffic e-commerce site in the middle of
the day or performing password-cracking tests in the middle of the night.
It’s amazing what a 12-hour time difference (2 p.m. during major production
versus 2 a.m. during down time) can make when testing your systems! Even
having people in different time zones can create issues. Everyone on the
project needs to agree on a detailed timeline before you begin. Having the
team members’ agreement puts everyone on the same page and sets correct
expectations.
If possible and practical, notify your Internet service providers (ISPs) or hosting
collocation (colo) providers. These providers have firewalls or intrusion
detection systems (IDS) or intrusion prevention systems (IPS) in place to
detect malicious behavior. If your provider knows you’re conducting tests, it’s
less likely to block your traffic.
Your testing timeline should include specific short-term dates and times of
each test, the start and end dates, and any specific milestones in between.
You can develop and enter your timeline into a simple spreadsheet or Gantt
chart, or you can include the timeline as part of your initial client proposal
and contract. Your timeline may also be work breakdown structures in a
larger project plan. A timeline such as the following keeps things simple and
provides a reference during testing:
Test Performed Tester Start Time Projected End Time
Web application
vulnerability
scanning
Tommy Tinker July 1, 06:00 July 1, 10:00
OS vulnerability
exploitation
Amy Trusty July 2, 12:00 July 2, 17:00
Running specific tests
You might have been charged with performing a general penetration test, or
you may want to perform specific tests, such as cracking passwords or trying
to gain access to a web application. Or you might be performing a social engineering
test or assessing Windows on the network. However you test, you
might not want to reveal the specifics of the testing. Even when your manager
41