Mastering Kali Linux for Web Penetration Testing

When to hit the big red button

Even with periodic reports to the customer, there will be times when a finding or result requires immediate disclosure and a work stoppage until given the go-ahead. Critical flaws that could result in data exfiltration, the discovery of an active attack, or even human resources related events (the discovery of a mole, insider threat, inappropriate content, and so on) should be disclosed immediately. In the course of developing the rules of engagement, you or the customer may add additional conditions based on the target environment's importance or role that also kicks off an immediate notification.

A non-disclosure agreement (NDA) obliges you to keep the test entirely within strict confidence, but it is these ...