Lion Cipher Lab
Measure critical-finding notification times against the rules of engagement
- Penetration Testing / Red Team
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Some findings cannot wait for the final report. A test account that can read cardholder data, domain admin credentials sitting in a share, or a web shell left by someone else are each exposures the client is carrying right now, and every hour the tester holds onto one is an hour the client carries it unknowingly. The rules of engagement (RoE), the agreement signed before testing, should say how fast each kind of finding must reach the client and through whom. The PCI SSC's penetration testing guidance lists 'a preferred method of communicating about scope and issues encountered' as an RoE…
What you'll learn
- writing notification windows into the rules of engagement
- measuring discovery-to-notification delay per finding
- treating evidence of a real attacker as its own, fastest category
- why 'told them the same day' is the wrong test
- spotting findings that were never escalated
- reading a median that hides a missing value
Steps in this lab
- Notification windows belong in the rules of engagement
- The engagement's notification log
- Write the timing check
- Run it: four breaches, one never sent
- Fix the process, report the gap