Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am still in college. Recently, I completed my OSCP and have been asked by my professor to do a robust pentest on our University's Network Infrastructure. Although I agreed, I have no idea regarding what paperwork should I present the university authorities.(If any)
A contract might look like an overkill, I just need something that protects me in the worst case scenario. Since I am an amatuer, any advice is much appreciated.
'Contract might be overkill'
When they sue you for damages, that contract will keep you from counting bars.
Get a lawyer, sit down with your professor and sketch out the scope. Then get a SoW signed by all authorized signatories of your university. There's no one size fits all solution.
You also say that you've exchanged a SoW over email - not enough. Get it signed on hard paper or using a online provider. It is extremely important that the signatories be authorized. I'm sure your professor is a nice person, but he could simple use you to discover holes in the system, sell them to a third party and throw you under the bus.
If you can't afford a lawyer, at least ensure that you're familiar with the local laws and regulations. I recommend that you read the PTES's Rules of Engagement. Some important points:
Ensuring that you have permission to test
Evidence handling
What to do when you come across personal information
The scope of the test
If you haven't already, I definitely recommend going through it. It'll keep you safe while you're working. Spending a night in the slammer is no fun.
Well, to start off, you have already finished your OSCP. However, I'm going to assume the reason why your professor asked you to pentest the University's Network is as a "final project" in which you make use of what you know. Saying that your interest is to test what you've learnt is a good idea.
Now, answering your question, Yes, you should present paperwork, but usually written evidence from the organization's authorities will do in most cases. An E-Mail from your professor, another one from the University's Authorities, and, if possible, another one from the IT department would usually be enough.
However, since Penetration Testing can be carried with bad intentions, I would advice you to talk to your teacher and ask him to not only e-mail you, but also to e-mail the University's Institution and the IT asking for permission.
I would say that written evidence is a must when talking about carrying Penetration Testing. I still recommend you the contract option, it may seem overkill, but it is, as I have said, the safest option. If I were you, I would get both a contract, and other evidence like e-mails, etc.
Hope it was helpful.
