Overview
Clear communication channels and procedures keep an engagement coordinated and safe — ensuring the right people are informed at the right times. This lesson covers communication in the ROE.
Learning objectives
- Explain the role of communication in an engagement.
- Describe communication channels and escalation procedures.
- Connect communication to safety and effective response.
Core concept
Communication rules define who to contact, how, and when during an engagement. They establish primary and backup points of contact, the channels to use, routine status updates, and — critically — escalation procedures for urgent situations: discovering a critical vulnerability, encountering signs of a real (pre-existing) breach, or causing/observing an operational problem. Good communication keeps both sides aligned and enables rapid, appropriate response.
How it works
The ROE names the contacts and the escalation path. During testing, the tester provides agreed status updates and immediately escalates urgent matters per the procedure. If a critical flaw is found, the owner is notified promptly so they can begin remediation (and so the tester can confirm how to proceed). If the tester sees indications of a genuine ongoing compromise (not their own testing), they escalate at once, since that is an active security incident. If testing inadvertently affects a system, the tester communicates immediately. This coordination prevents confusion and enables timely action.
Practical example
The ROE lists a primary contact with a phone number for urgent issues and requires daily status updates. Mid-engagement, the tester discovers a critical, easily exploitable flaw and — per the escalation rule — notifies the contact immediately rather than waiting for the daily update. Separately, on spotting signs that suggest a real attacker may already be in the environment, the tester escalates at once as a potential live incident. Clear communication ensured both were handled promptly and appropriately.
Cybersecurity relevance
Communication procedures are essential to a safe, coordinated engagement: they ensure critical findings are acted on quickly, operational issues are addressed immediately, and — importantly — that signs of a real breach are escalated as the security incident they are. Poor communication leads to delays, confusion between test and real activity, and missed urgent issues. Defined channels and escalation paths are a hallmark of professional engagements and protect both the owner and the tester.
Common mistakes
- No clear point of contact or escalation path for urgent situations.
- Delaying notification of critical findings or operational problems.
- Failing to escalate signs of a real, pre-existing breach as a live incident.
Key takeaways
- Communication rules define contacts, channels, status updates, and escalation procedures for urgent situations.
- Escalate promptly for critical vulnerabilities, operational problems, and — especially — signs of a real ongoing breach (a live incident).
- Clear communication keeps the engagement coordinated and safe and enables timely, appropriate response; it is a hallmark of professionalism.
Check your understanding
- What kinds of situations require immediate escalation during an engagement?
- Why is it important to escalate signs of a real, pre-existing breach rather than continue testing?