CEH Domain 4: Procedures, Reporting & Legal

Why Domain 4 matters: Technical exploits are easy; the hard part of an engagement is what surrounds them - a defensible scope, a methodology the client can audit against, a report a CEO and a sysadmin can both act on, and a legal posture that keeps the tester out of court.

1. Penetration Testing Methodology

1.1 Engagement Types

Type	Knowledge the tester has	Realism vs. cost	Typical use
Black-box	Only public info (domain, company name)	Highest realism, lowest efficiency	External adversary simulation
White-box	Full source code, network diagrams, credentials	Lowest realism, highest coverage	Code review, internal audit, SDLC
Gray-box	Partial knowledge (e.g., low-privilege account)	Balanced	Most common commercial engagements

A gray-box engagement with one user credential is the de-facto industry default - it produces realistic attack paths without paying for a full black-box reconnaissance phase. Source: https://owasp.org/www-project-web-security-testing-guide/v42/3-The_OWASP_Testing_Framework/0-The_Web_Security_Testing_Framework

1.2 The Pen-Test Lifecycle

Phase	Key activities	Output / deliverable
1. Planning & Scoping	Objectives, IP/domain scope, time windows, ROE, kill-switch, contacts, indemnity	Signed ROE, MSA, Permission-to-Test
2. Information Gathering	OSINT, DNS enumeration, service fingerprinting, social-media harvesting	Target inventory, attack-surface map
3. Threat Modeling	STRIDE on DFDs, DREAD/PASTA scoring, attack-tree construction	Prioritized threat list with risk score
4. Vulnerability Scanning	Automated scanners (Nessus, Qualys), manual verification, false-positive removal	Vulnerability list, CVSS v4.0 ratings
5. Exploitation	Validate flaws safely, capture evidence, build PoC, establish foothold	PoC evidence, exploited-vuln list
6. Post-Exploitation	Lateral movement, privilege escalation, data-exfil simulation (safely)	Attack-path narrative, blast-radius assessment
7. Reporting & Retest	Executive + technical report, remediation roadmap, retest fixed findings	Final report + retest sign-off

PTES, NIST SP 800-115 and the OWASP WSTG converge on this sequence. PTES names seven sections - Pre-engagement, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post Exploitation, Reporting - and is the most widely cited phase list. NIST SP 800-115 collapses the flow into Planning, Discovery, Attack, Reporting and stresses that planning, with written authorization and an evidence-handling plan, must close before technical work. Sources: http://www.pentest-standard.org/index.php/Main_Page ; https://csrc.nist.gov/pubs/sp/800/115/final

Key takeaway: “Get out of jail free” is not a metaphor. The Permission-to-Test document is the single most important artifact of a legal engagement. If the engagement is verbal, the engagement is a crime.

1.3 Rules of Engagement (ROE) - what the document must contain

OSSTMM sets the de-facto ROE template and requires the following in writing and signed before testing: scope, test window and man-hours, tester source IP / phone numbers, emergency contacts, DoS/social-engineering permissions, SOW change-control, data-handling rules, and limited liability equal to the cost of service. OSSTMM also forbids Distributed DoS testing over the Internet and any “flood testing” where a stronger source overwhelms a target - non-negotiable ethical limits for a STAR-certified audit. Source: https://www.isecom.org/OSSTMM.3.pdf

1.4 Threat Modeling

Model	Type	Best for	Output
STRIDE	Threat category mnemonic (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege)	Design-time classification of what can go wrong	Threat list per DFD element
DREAD	1-10 scoring (Damage, Reproducibility, Exploitability, Affected Users, Discoverability)	Ranking threats already identified	Numerical risk score per threat
PASTA	7-stage attacker-centric methodology tied to business risk	High-value systems, regulated industries	Risk-weighted attack scenarios
Attack Trees	AND/OR decomposition of attacker goals	Visual reasoning about complex chains	Tree diagram + leaf-node costs

STRIDE and DREAD are commonly combined - STRIDE finds threats, DREAD ranks them. PASTA is reserved for components where the cost of failure justifies days of work. Source: https://owasp.org/www-community/Threat_Modeling_Process

1.5 Risk Rating

CVSS v4.0 produces a 0.0-10.0 score: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0). v4.0 splits the calculation into Base, Threat, Environmental and Supplemental metric groups - Base alone measures severity, not risk. Source: https://www.first.org/cvss/v4.0/specification-document
DREAD averages the five dimensions; 40-50 critical, 30-39 high, 20-29 medium, below 20 low.
OWASP Risk Rating combines Threat Agent × Vulnerability × Technical Impact × Business Impact, then maps to Low/Medium/High.

Key takeaway: CEH exam items frequently test that CVSS Base measures severity, not risk, and that a single CVSS number is insufficient - context (environment, threat intel) must be layered on.

2. Reporting & Communication

2.1 Report Structure (industry baseline)

Cover page & version control - version, date, classification, distribution.
Executive Summary - 1 page, business risk language, no jargon. For the CISO/board.
Scope - what was tested, out-of-scope, testing window, methodology.
Methodology - phases, tools (versions), standards followed (PTES, NIST 800-115, OWASP WSTG).
Findings - one section per finding, ordered by severity: title, CVSS, asset, description, evidence, impact, remediation, references.
Risk Rating - summary table of all findings.
Remediation Roadmap - prioritised, time-bound, owner-assigned.
Appendix - raw scanner output, evidence chain, glossary.

2.2 Severity Levels

Level	CVSS v4.0 band	Typical SLA
Critical	9.0-10.0	24-72 hours
High	7.0-8.9	7-14 days
Medium	4.0-6.9	30 days
Low	0.1-3.9	90 days
Informational	n/a	Best-effort

2.3 Evidence and Chain of Custody

Every finding needs a unique ID, timestamp, asset identifier, the exact payload or command, the response observed, a hash of any captured artifact, and the tester’s name - a chain of custody that survives litigation. Screenshots are weak evidence; the underlying HTTP request/response, log entry or DB query is primary. Source: https://owasp.org/www-project-web-security-testing-guide/v42/3-The_OWASP_Testing_Framework/0-The_Web_Security_Testing_Framework

2.4 Stakeholder-Specific Reporting

CISO / Board - risk in dollars, regulatory exposure, peer comparison.
IT Operations - affected host, patch command, validation script.
Developers - code snippet, root cause, suggested fix with reference.
Legal / Compliance - regulatory mapping (PCI, GDPR, HIPAA), breach-notification trigger.

Best engagements also include a verbal debrief so engineering can ask questions live.

3. Legal & Regulatory

3.1 Singapore - the legal home of this engagement

🇸🇬 Singapore-Specific Legal Box (CMCA + PDPA + CSA)

Computer Misuse Act 1993 (CMA/CMCA) - Section 3(1) makes it an offence to knowingly cause a computer to perform any function for the purpose of securing access without authority. Penalty: up to S$5,000 fine, 2 years imprisonment, or both. Section 12 criminalises attempts and preparatory acts - an unsuccessful test is still an offence. Written authorisation from the system owner is the only shield. Source: https://sso.agc.gov.sg/Act/CMA1993

Personal Data Protection Act 2012 (PDPA) - If a pen-test accesses personal data, the Protection Obligation (Part 4) and Data Breach Notification (Part 6A) apply. A notifiable breach must be reported to the PDPC within 3 calendar days; penalties reach S$1 million or 10% of annual Singapore turnover (whichever is higher). Source: https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-selected-topics/advisory-guidelines-on-the-pdpa-for-selected-topics-%28revised-may-2024%29.pdf

Cybersecurity Act 2018 (amended, in force 31 Oct 2025) - Regulates CII operators across 11 sectors and licences two service types: penetration testing and managed SOC monitoring. Providers must hold a CSA licence (from 16 Mar 2026, an active Cyber Trust mark Promoter / Tier 3). Source: https://sso.agc.gov.sg/Act/CA2018

Practical implication for CEHs in Singapore: Obtain (a) written authorisation from the system owner, (b) separate consent if the system holds personal data, (c) confirmation of CSA licence status if licensable, and (d) a data-handling plan for any PDPA-relevant records. The “kill-switch” must be reachable 24/7.

3.2 United States - federal statutes

CFAA - 18 U.S.C. §1030. Two operative phrases: “without authorization” and “exceeds authorized access.” After Van Buren v. United States (2021), “exceeds authorized access” applies only to areas the user is not entitled to enter - not to misusing information the user can otherwise see. The CFAA has no pen-test exemption; authorization is the only defence. Source: https://www.justice.gov/jm/jm-9-48000-computer-fraud
DMCA §1201 prohibits circumvention of technological protection measures; security research needs the triennial exemption or rights-holder consent.
ECPA restricts interception of electronic communications - relevant for packet capture and any test that includes content interception.

3.3 Other jurisdictions

UK Computer Misuse Act 1990 - Section 1 unauthorized access, Section 3 unauthorized acts with intent to impair. No statutory pen-test defence; common-law “authorized access” via explicit consent is the only protection.
EU GDPR - Article 32 obliges “regular testing” of security measures; a DPIA (Article 35) is required where testing likely impacts personal data.

3.4 Ethics codes

EC-Council Code of Ethics (CEH) - 25 articles. Core clauses: (12) “Ensure all penetration testing activities are authorized and within legal limits”; (13) “Not to take part in any black hat activity”; (16) “Not convicted of any felony, or violated any law of the land.” Violations can lead to decertification. Source: https://www.eccouncil.org/code-of-ethics/
(ISC)² Code of Ethics - four canons (Protect society, act honorably, provide competent service, advance the profession). CISSP holders are bound.
ACM Code of Ethics - general computing ethics, applies to researchers.

3.5 Pen-Test vs Red Team vs Bug Bounty vs Vulnerability Assessment

Practice	Goal	Scope	Timeframe	Output
Vulnerability Assessment	Find as many flaws as possible	Broad, asset-list based	Periodic	Prioritised remediation list
Penetration Test	Find and exploit vulns to prove impact	Defined, ROE-bounded	Time-boxed (1-4 weeks)	Report with PoC + remediation
Red Team	Emulate a real adversary; test detection and response	Broad, objective-driven, often surprise	Weeks to months	Attack-path narrative + blue-team gaps
Bug Bounty	Continuous crowdsourced discovery	Public-facing assets, in-program scope	Continuous	Triage queue + paid reports
Gray-Box Audit	Audit with limited insider knowledge	One or more user roles	Time-boxed	Compliance-style report

These are not interchangeable. Common anti-patterns: launching a bug bounty before you have a triage team, or commissioning a red team before basic hygiene (logging, patching, asset inventory) exists. Source: https://danielmiessler.com/blog/when-vulnerability-assessments-pentesting-red-team-bug-bounties

Key takeaway: “Pen-test” is the most over-used word in cybersecurity procurement. Match the engagement type to the question you actually want answered. Compliance? → Pen-test. Detection maturity? → Red team. Continuous discovery at scale? → Bug bounty.

3.6 The “Get Out of Jail Free” Package

A defensible authorisation package contains the MSA (commercial terms), SOW (scope, deliverables, timeline), Permission to Test (PTT) (explicit written authorisation from the legal owner of every in-scope system, naming IPs, domains, time window), ROE (methods, contacts, kill-switch, evidence handling), NDA (confidentiality of findings), and third-party authorisations (for cloud, CDN, MSSP where AWS, Azure, Cloudflare, etc. is not the client). Without the PTT and third-party authorisations, the test is technically a criminal act under the CMA, CFAA, or the relevant local statute.

4. Compliance Frameworks

Framework	Scope	Pen-test obligation	Regulator
PCI DSS v4.0 / v4.0.1	All entities that store, process or transmit cardholder data	Req 11.4: external + internal pentest annually + after significant change; segmentation pentest annually (merchants) or 6-monthly (service providers)	PCI SSC, acquiring bank
ISO/IEC 27001:2022	ISMS certification, any industry	Annex A 8.8 technical compliance testing	Accreditation bodies
NIST CSF 2.0	US framework, voluntary globally	DE.CM-9 “Tests are performed”	n/a (voluntary)
SOC 2 (TSC)	US service organisations	CC7.1 vulnerability management	AICPA-licensed CPAs
HIPAA Security Rule	US healthcare	45 CFR §164.308(a)(8) periodic technical testing	HHS / OCR
GDPR	EU personal data	Art. 32 “regular testing of effectiveness of measures”	National DPAs
CSA CCM v4	Cloud providers	IVS-09 Penetration Testing	CSA STAR registry
FedRAMP	US federal cloud	Continuous monitoring + annual 3PAO assessment	FedRAMP PMO / GSA

PCI DSS v4.0.1 Req 11.4 is the most prescriptive - methodology from an approved list (NIST 800-115, OWASP, PTES, OSSTMM), internal + external tests annually, segmentation testing (annual merchants, six-monthly service providers), mandatory retesting after remediation, and organisational independence of the tester. A quarterly ASV scan does not satisfy Req 11.4.

Key takeaway: Memorise the PCI DSS 11.4 lifecycle: external + internal annually, segmentation twice-yearly for service providers, retest after fix, methodology from an approved list.

Sources

PTES - Penetration Testing Execution Standard. http://www.pentest-standard.org/index.php/Main_Page
NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment. https://csrc.nist.gov/pubs/sp/800/115/final
OSSTMM 3 - Open Source Security Testing Methodology Manual. https://www.isecom.org/OSSTMM.3.pdf
EC-Council Code of Ethics. https://www.eccouncil.org/code-of-ethics/
OWASP Threat Modeling / WSTG v4.2. https://owasp.org/www-community/Threat_Modeling_Process
FIRST CVSS v4.0 Specification. https://www.first.org/cvss/v4.0/specification-document
Singapore Computer Misuse Act 1993 (CMA/CMCA). https://sso.agc.gov.sg/Act/CMA1993
Singapore PDPC Advisory Guidelines on the PDPA (May 2024). https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-selected-topics/advisory-guidelines-on-the-pdpa-for-selected-topics-%28revised-may-2024%29.pdf
Singapore Cybersecurity Act 2018 (amended). https://sso.agc.gov.sg/Act/CA2018
US DOJ - CFAA manual (18 U.S.C. §1030). https://www.justice.gov/jm/jm-9-48000-computer-fraud
PCI SSC - PCI DSS v4.0.1. https://www.pcisecuritystandards.org/
ICLG Cybersecurity Laws & Regulations 2026 - Singapore. https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/singapore/