Preparation

Summary

This component consists of trip preparation activities that are needed to ensure the technical and facilitated components of the audit are able to be conducted effectively and within the on-site time-frame and in coordination with the organization.

Purpose

A SAFETAG audit has a short time frame. Preparation is vital to ensure that time on the ground is not spent negotiating over the audit scope, updating the auditors systems, searching for missing hardware, or refreshing oneself with the SAFETAG framework. To that end negotiations with the host organization help reveal if the organization has the capacity to undertake the audit and respond to its findings.

Guiding Questions

• Does the organization have existing digital security practice or attempted to implement them in the past?
• What is the process for procedure for incident handling in the event that auditor cause or uncover an incident during the course of the assessment?
• What are the legal, physical, or social risks for the auditor & organization associated with conducting the audit or having audit results leak? ¹
• Does the security situation of the location or organization require additional planning? Are your software tools up to date and working as expected?

The Flow of Information

Approaches

• Create an Assessment Plan: Have a "scoping" meeting that outlines the level of access that an auditor will have, what is off limits, and the process for modifying the scope of the audit when new information arises. ^2,3
• Negotiate a Confidentiality Agreement: Negotiate an agreement with the organization that outlines how an auditor will protect the privacy of the organization and the outcomes of the audit.
• Establish an Emergency Contact: Establish a procedure for incident handling and an emergency contact in the event that auditor cause or uncover an incident during the course of the assessment. ^4,5
• Prepare for Travel: Check travel logistical needs -- visa, letter of invitation, travel tickets and hotel reservations. Note that some visas can take significant effort and may require the auditor to be without a passport while they are being processed.
• Prepare Systems: Update and test your systems, A/V and audit tools. ⁶, prepare storage devices and systems to reflect the required operational security, and ensure you have power supply adapters, cables and relevant adapters, usb drives, external wireless cards and any other equipment needed for testing. ⁷^, ^⁸

Outputs

• Any Visas or paperwork needed, plus travel arragements (tickets, hotels) for auditor travel.
• A custom password dictionary. ⁹
• A travel kit. ^10,11
• Systems updated and ready for testing.
• Risks to host and auditor conducting a SAFETAG audit.
• Modifications to the audit plan as necessary.

Operational Security

• Update your OS, software, anti-virus, firewall settings, etc. (Do not be the weakest link for the host!)
• Determine the correct visa process for your trip.
• Carefully consider packing needs and explanations

Resources

Activities

undefined

---

1. " Some activities common in penetration tests may violate local laws. For this reason, it is advised to check the legality of common pentest tasks in the location where the work is to be performed."↩

2. " Some activities common in penetration tests may violate local laws. For this reason, it is advised to check the legality of common pentest tasks in the location where the work is to be performed."↩

3. "In addition, some service providers require advance notice and/or separate permission prior to testing their systems. For example, Amazon has an online request form that must be completed, and the request must be approved before scanning any hosts on their cloud. If this is required, it should be part of the document."↩

4. NIST SP 800-115, Technical Guide to Information Security Testing and Assessment. Section 7.1 Coordination↩

5. "Obviously, being able to get in touch with the customer or target organization in an emergency is vital."↩

6. See the auditor trainee resource list↩

7. APPENDIX A - Auditor travel kit checklist↩

8. "Traveling teams should maintain a flyaway kit that includes systems, images, additional tools, cables, projectors, and other equipment that a team may need when performing testing at other locations."↩

9. Auditor Tool Resource List - Password Dictionary Creation↩

10. APPENDIX A - Auditor travel kit checklist↩

11. "Traveling teams should maintain a flyaway kit that includes systems, images, additional tools, cables, projectors, and other equipment that a team may need when performing testing at other locations."↩