Scope Worksheet:
What are the target organization's biggest security concerns:
(Examples include disclosure of sensitive information, interruption of production processing, embarrassment due to website defacement, etc.)
_______________________________________________________________________
What specific hosts, network address ranges, or applications should be tested:
What specific hosts, network address ranges, or applications should explicitly NOT be tested:
List any third parties that own systems or networks that are in scope as well as which systems they own (written permission must have been obtained in advance by the target organization):
Will the test be performed against a live production environment or a test environment:
______________________________________________________________________
Will the penetration test include the following testing techniques:
Ping sweep of network ranges: ____________________________________________
Port scan of target hosts: _________________________________________________
Vulnerability scan of targets: ______________________________________________
Penetration into targets: __________________________________________________
Application-level manipulation: ____________________________________________
Client-side Java/ActiveX reverse engineering: _________________________________
Physical penetration attempts: ______________________________________________
Social engineering of people: _______________________________________________
Other: _________________________________________________________________
Will penetration test include internal network testing: ____________________________
If so, how will access be obtained: ___________________________________________
________________________________________________________________________
Are client/end-user systems included in scope: _________________________________
If so, how may clients be leveraged: __________________________________________
Is social engineering allowed: _______________________________________________
If so, how may it be used: __________________________________________________
Are Denial of Service attacks allowed: _____________________________________
Are Dangerous checks/exploits allowed: ____________________________________
______________________________________________________________
Signature of Primary Contact representing Target Organization
____________________________
Date
Signature of Head of Penetration Testing Team
wasylziomek