Professional Red Teaming: Conducting Successful Cybersecurity Engagements

© Jacob G. Oakley 2019

Jacob G. OakleyProfessional Red Teaminghttps://doi.org/10.1007/978-1-4842-4309-1_5

5. Rules of Engagement

Jacob G. Oakley¹ 

(1)

Owens Cross Roads, AL, USA

 

The rules of engagement, or ROE, dictate the “how” involved in accomplishing assessment of what was defined in the scope after the shaping phase is complete. The legitimacy and legality of all actions the red team takes while conducting the assessment are ratified by the ROE. A well-established and agreed-to ROE document must be acknowledged and signed by both customer and providing parties. If not, the offensive security engagement by ethical hackers is considered in violation of the Computer Fraud and Abuse Act (CFAA), which constitutes a federal crime in the United States; ...