Greetings! Many thanks to those that responded. As it is traditional and polite, I am writing a summary of the replies. HOW TO GO ABOUT FINDING A SUITABLE PEN-TESTER: 1. Get references from your friends in the same industry. This will help short-list the companies you can trust. If you still aren't certain just go with a big well known firm. 2. Hire a consultant if necessary and define the scope of work to the Pen-testers. I'd say both an internal and external audit should be done. You should ask the pen-testers for suggestions. 3. Go over their terms and conditions carefully. As with any TOS, have your lawyer review it, and discuss anything you don't like with the Pen-testing company. Good thing to have is a second audit after recommended changes are made. 4. Ask the company for details on the consultants who will be carrying out the work. Although it does not prove anything, a Certified Information Systems Security Professional (CISSP) would probably be a good idea. 5. Ask the company about bonding and Insurance. If they don't have a clue, dump 'em. 6. It is blatantly obvious to us that a pen-test covers the system only at the time of testing. Any pen tester that says otherwise is out of his mind. But, the customer may think, kewl, had only one hole, its fixed, and I am secure. If the pen-tester assures you that there are no worries once the test is complete, thinking you are not smart enough, then run. In fact, if the pen-tester suggests anything ridiculous or questionable, back off. You may be wrong, but don't risk trusting your companies secrets to anyone if they try to scare you in to hiring them, or if they make unrealistic claims. 7. Implement the changes as suggested by the pen-testing report. Audit your network again by the same pen-tester, if everything goes well, there won't be any major issues. If there are issues, keep on fixing the holes and repeat the audit, until there are no issues. 8. If you are paranoid, now go and find a second pen-tester and have another audit done. This will give you a useful second opinion. That's all for now, many thanks to kevin,steve,modify,hellnback,etaoin and others.
This archive was generated by hypermail 2b30 : Sun Jun 03 2001 - 23:22:39 PDT