Question

A penetration testing firm is finalizing pre-engagement paperwork for a client. During scoping, the client's IT manager verbally authorizes testing of a marketing web application that is hosted and fully managed by a separate managed service provider (MSSP). The IT manager insists this asset is 'in scope' and asks the testers to begin immediately. What is the tester's most appropriate action before testing that application?

Accepted Answer

Obtain written authorization from a party with the legal authority to permit testing of the MSSP-managed asset before including it in scope

Answer

Begin testing immediately since the IT manager has operational responsibility for the marketing application

Answer

Add the application to the scope document and note the IT manager's verbal approval in the final report

Answer

Exclude the application from all testing and reporting because MSSP-hosted assets can never be tested