Lion Cipher Lab
Verify penetration test evidence was destroyed as the contract requires
- Penetration Testing / Red Team
- Intermediate
- ~35 min
- Free · no account required
Why it matters
A penetration test leaves the tester holding things a criminal would pay for: samples of cardholder data, password hashes, cracked passwords, HR exports, screenshots of internal systems. The rules of engagement should say how long the tester may keep them. The PCI SSC's penetration testing guidance asks whether 'sensitive data shown to be accessible during the test [will] be retained by the tester during and after the penetration test' and says any cardholder data obtained must be secured in accordance with PCI DSS. Destruction is where firms quietly fail. The copy on the laptop is wiped and…
What you'll learn
- keeping an inventory of every copy of engagement evidence
- checking destruction against contract deadlines
- proving WHICH file was destroyed with a hash check
- finding the copy that was forgotten
- spotting destruction records that match nothing in the inventory
- choosing a sanitization method that suits the medium
Steps in this lab
- Destruction has to be complete and provable
- The evidence inventory and the destruction log
- Write the destruction check
- Run it: five problems, one of them urgent
- Fix the gaps, and report them honestly