Lion Cipher Lab
Budget a web test's request volume against the RoE rate limit and window
- Penetration Testing / Red Team
- Intermediate
- ~30 min
- Free · no account required
Why it matters
Production systems are often tested under conditions the client sets to protect the service: a maximum request rate and a testing window, typically at night. NIST SP 800-115 lists 'performing testing off-hours' among the ways to reduce the risk testing poses to availability, and says organizations should decide their acceptable level of intrusiveness. The PCI SSC's penetration testing guidance names the testing time window as a rules-of-engagement question. Those two numbers set a hard budget. Testers rarely check their plan against it. They start the tools at default speed (breaking the rate…
What you'll learn
- turning an RoE rate limit and testing window into a request budget
- estimating each task's request volume
- filling the budget in priority order
- deciding what to cut before the test, not during it
- why tool default speeds break agreed limits
- raising a scope problem with numbers
Steps in this lab
- A rate limit and a window are a budget
- The test plan
- Write the budget check
- Run it: 132% of the allowance
- Take the numbers to the client before night one