From my previous question, I've seen that a "Permission to Attack" slip is crucial in ANY Penetration Test. However, that question and its answers and comments have only discusses interactions between the Pentesters and the client's party (their staff).
How should we deal with 3rd parties such as:
- 3rd party staff (real elevator maintenance, real CISCO staff, etc)
- Non-staff people (customers of the company, guests, patients in a hospital, etc)
- Local law enforcement (the police)
- A real possible criminal (having both a Red Team and real criminals breaking in at the same time sounds tough)
I've seen (read articles) some say that we should always tell the police the truth rather than try to social engineer them. I've also heard people talk about themselves tricking local police like staffed security. Some also say that we should present and confirm our Permission to Attack with local law enforcement beforehand as we would with the employer.