Rules of engagement (pentest)
Rules of engagement are the document that defines, before a penetration test, which systems may be attacked, with which techniques, during which hours and whom to contact if a problem arises. For example, they may exclude social engineering or prohibit denial-of-service testing during business hours; they protect the company and give the testing team legal authorization.
How TecnetOne handles it: Penetration Testing
ROE, pentest rules of engagement, penetration test scope, testing authorization letter, pentest scoping
Related terms
Compromise assessment
A compromise assessment is a review that looks for evidence that an attacker is or was inside an organization's network, even if no incident has been detected. It analyzes endpoints, accounts, logs and traffic for indicators of compromise; it is useful, for example, for a company without a SOC (security operations center) before an acquisition or after an isolated alert.
FIM (file integrity monitoring)
File integrity monitoring (FIM) is a control that compares critical system, configuration and application files against a baseline and raises an alert when someone creates, modifies or deletes them. For example, it detects a change to a configuration file on a payment server; PCI DSS (Payment Card Industry Data Security Standard) requires this type of control, and platforms such as Wazuh include it.
Vulnerability management
Vulnerability management is the continuous process of identifying, classifying, prioritizing, remediating and verifying security weaknesses across an organization's systems. Unlike a one-time assessment, it runs in cycles: for example, weekly scans of servers and endpoints, prioritization based on CVSS (Common Vulnerability Scoring System) scores and real exposure, and tracking each patch until the fix is confirmed.
PTaaS (Penetration Testing as a Service)
PTaaS (penetration testing as a service) is a model in which penetration tests are purchased as a recurring or continuous service instead of a one-off annual project. It usually includes a platform to review findings, prioritize them and request retesting of fixed issues. For example, testing each new release of a web application before it goes live.
Cyber hygiene
Cyber hygiene is the set of basic security habits and practices that people and organizations apply consistently to keep their devices, accounts and data in good condition. It includes patching systems, using unique passwords with multi-factor authentication (MFA), backing up data and reviewing access; for example, disabling the accounts of staff members who have left the company.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.