> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/getting-started/adversary-emulation-vs-simulation/primum-non-nocere.md).

# Primum non nocere

#### Primum non nocere

> The latin phrase "primum non nocere" - "first, do no harm" in English - is most often associated with the Hippocratic Oath of the medical profession. The idea being that doctors should not risk doing more harm than good to their patients. 
>
> \
> As security professionals, it's a nice philosophy to follow because we don't want to harm or weaken the security of our clients. (here to improve security)
>
> As with the most things in life however, it's not that simple. If doctors were to take this literally, nobody would ever have surgery, give blood, or receive any procedure that did any amount of harm to them. Clearly, some harm is worth enduring for the potential benefits.

In context of red teaming, we have ability to perform harmful actions

Examples:

* Disabling security controls such as AV or firwalls
* Adding users to privileged groups, like local or domain admins.
* Creating various administrative backdoors to systems.

The reason these are dangerous is because once in-place, you cannot guarantee that they won't be abused by another party and that increases the risk exposure of the client.

> Note: If the client want us to replicate like disabling security controls such as AV or firewalls or create backdoors or add privileged users to admin rights and etc. It should be done in a safe and controlled fashion only. If not, it will give an entry to the Real Adversaries. 

* Just like a surgeon would not cut you open without due course or the appropriate consent: we should refrain from harmful actions without the consent of our clients.
* Everybody's feeling for what is and is not, appropriate will be different, so these boundaries should generally be agreed and documented before the engagement starts. 
* However, when in doubt, seek advice from your team lead or client contact.