no knowledge of the system, tester is operating as if they were an outside attacker
attacker has no knowledge of the network environment (external attack)
no prior knowledge of the system or network to be assessed