Haverbrook Investment Group (HIG)

Rules of Engagement Overview Haverbrook Investment Group (HIG) is a financial-based organization. Following their customer-centric approach to business, the organization has witnessed a positive growth of their company and information technology. To enhance the security of their systems, the organization has hired Centralia Security Lab (CSL) to carry out penetration testing on their system. The main aim of the pen test is to establish the effectiveness and performance of the systems. Penetration test involves activities executed to determine any vulnerabilities. The attack can be executed in three phases: • Pre attack: The objective is to design plans and gather as much information as possible about the target through passive and active reconnaissance. • Attack: Use the information obtained from the pre-attack phase to exploit vulnerabilities • Post attack phase: This is an essential phase in penetration testing, it involves destruction, cleaning, and reporting of artifacts. The main goal of Rules of Engagement (ROE) is to describe the manner in which CSL will organize the penetration test. ROE provides guidance to system administrators, stakeholders, user requirements, and make agreements through legally defined documents. The companies have met to collect the required resources for penetration testing. The contract defines the objectives of the test, handling of sensitive information, reporting, and responsibilities.