PREPARE FOR UNCERTAINTY The SAFETAG roadmap is a crisp, clear data flow of inputs to outputs. Reality, generally speaking, is less direct. There are a few core parts of the audit process that force action, but others are more flexible. Outcomes of your discussion and exploration of the network will also de-rail the process in impossible-to-predict ways. The pre-audit interviews and your own contexts research, research on the organization, and preparation are meant to give you the best possible idea of what situation you'll walk in to, but even with all of that, frankly, shit happens. Before Travel Agreements, Scope, Risk Analysis Remote Research Openly sourced data: DNS, MX, Web, research via social media and google Revealed information via Skype / etc. (office IP address?), nmap Packing and Prep Visas / Travel planning Hardware packing Software (run updates) and dictionary list prep (local language dictionaries, plus creation of a custom password list based on website keywords, addresses, and dates) FIRST DAY Priorities for the first day include meeting staff (even, possibly especially, for the more technical auditor). There is a strong temptation to dive in and get started, but establishing connections with the staff - especially those you haven't met through interviews - is key. You may discover hidden sources of talent or resistance, historical information, and new parts of the infrastructure or practices and policies that you may not have yet found. Meet staff, discuss operations and plan interruptions with key staff In-person discussions of risks, challenges, fears, questions, and experiences around digital security (If relevant) Attempt to crack wifi without password knowledge Parallel, collect wifi beacons while not associated to any one network (sending connection resets). Once wifi password is obtained (through cracking or asking), start a capture of decrypted traffic and run it as long as possible for later analysis Map out the “visible” network (nmap) EARLY STEPS Page 19 of 240