Overview
Timing rules define when testing may occur, protecting operations from disruption and coordinating the engagement. This lesson covers timing in the rules of engagement.
Learning objectives
- Explain why timing is part of the ROE.
- Describe testing windows and blackout periods.
- Connect timing to operational safety and coordination.
Core concept
Timing rules specify the windows during which testing is authorized and any blackout periods when it must not occur. They may confine intrusive testing to off-peak hours, avoid business-critical periods (e.g. end-of-quarter processing, major events), and set the overall engagement schedule. Timing ensures testing does not disrupt operations at sensitive moments and that the owner's team can be prepared and available during active testing.
How it works
The owner and tester agree the schedule in the ROE. The tester performs authorized (especially potentially disruptive) activities only within the allowed windows and avoids blackout periods entirely. Coordinating timing lets the owner monitor for impact, distinguish test traffic from real incidents, and have staff available to respond to critical findings. Some low-impact activities might be allowed more broadly, while intrusive tests are tightly scheduled. Respecting timing prevents the engagement from causing harm at the worst possible moment.
Practical example
An ROE authorizes intrusive testing only between 10 PM and 4 AM and declares a blackout during a major product launch week. The tester schedules scanning and other potentially disruptive activities within the night window and pauses entirely during the launch blackout. This ensures that if a test ever causes instability, it happens when impact is lowest and staff are prepared — not during peak business or a critical launch.
Cybersecurity relevance
Timing rules protect operational continuity and enable coordination: they keep potentially disruptive testing away from critical business periods, help the owner distinguish sanctioned test traffic from a real attack, and ensure responders are available. Ignoring timing can cause outages at the worst time or trigger false-alarm incident responses. Adhering to the schedule is part of conducting a safe, professional engagement, alongside scope and exclusions.
Common mistakes
- Testing outside authorized windows or during blackout periods.
- Running intrusive tests during peak business hours, risking disruption.
- Not coordinating timing, causing the owner to mistake test traffic for a real attack.
Key takeaways
- Timing rules define authorized testing windows and blackout periods, often confining intrusive tests to off-peak hours.
- They protect operations from disruption at sensitive times and let the owner prepare, monitor, and distinguish test traffic from real attacks.
- Respecting timing is part of a safe, coordinated, professional engagement alongside scope and exclusions.
Check your understanding
- Why might intrusive testing be confined to off-peak hours or blackout periods be defined?
- How does coordinating timing help the owner distinguish testing from a real attack?