Penetration Testing mailing list archives
RE: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..)
From: "Clement Dupuis" <cdupuis () cccure org>
Date: Fri, 12 May 2006 19:02:58 -0500
Good day to all, There is a sample document on the www.professionalsecuritytesters.org that you can use to create your own. It has good tips and include limitation of liability. You can get it at: http://www.professionalsecuritytesters.com/Documents/getoutofjail/getoutofja il.doc Do take care Clement Clément Dupuis, CD Maintainer of : The CISSP and SSCP Open Study Guides Web Site http://www.cccure.org The Professional Security Testers Warehouse http://www.professionalsecuritytesters.org -----Original Message----- From: Paul Asadoorian [mailto:paul () pauldotcom com] Sent: Friday, May 12, 2006 12:22 PM To: Michael Sierchio Cc: pen-test () securityfocus com Subject: Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Michael, I typically refer to the following document from the SANS Policy resources: http://www.sans.org/resources/policies/Audit_Policy.doc I modify this for internal permission slip purposes (i.e. the network security group has permission to do X, Y, Z on the network) and for external engagements as well. I'd be very interested in hearing people's thoughts/comments. Thank You, Paul - -- Paul Asadoorian Email: paul () pauldotcom com Web: http://pauldotcom.com IRC: #pauldotcom on Freenode (irc.freenode.net) Fingerprint: 2693 0204 8497 2E5F 4853 11D5 1153 6151 487F E094 On May 11, 2006, at 7:18 PM, Michael Sierchio wrote:
I'd be very much interested in whether there is a consensus document used by those performing vulnerability assessments that specifically authorizes pen testing which is sufficiently robust to protect the consultant from civil and criminal action. Would anyone care to share, comment, etc.? Thanks in advance. - Michael ---------------------------------------------------------------------- -------- This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ---------------------------------------------------------------------- --------
- -- Paul Asadoorian Email: paul () pauldotcom com Web: http://pauldotcom.com Fingerprint: 2693 0204 8497 2E5F 4853 11D5 1153 6151 487F E094 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEZMRREVNhUUh/4JQRAkFGAKDf6fxkYDBMfvIQLIKYlBf9mxKcfgCfTEcn OOM7FBrKpjCzQ+u9WNhcbs0= =MBiV -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- -- This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ---------------------------------------------------------------------------- -- ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ------------------------------------------------------------------------------
Current thread:
- Re: Pentester convicted.., (continued)
- Re: Pentester convicted.. Art Cooper (May 12)
- Re: Pentester convicted.. Phoebe Tunstall (May 12)
- Re: Pentester convicted.. Jason Ross (May 11)
- Re: Pentester convicted.. John Kinsella (May 11)
- RE: Pentester convicted.. Sahir Hidayatullah (May 11)
- Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Michael Sierchio (May 12)
- Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Dana (May 12)
- Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Jeremiah Cornelius (May 12)
- Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Dotzero (May 12)
- Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Paul Asadoorian (May 12)
- RE: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Clement Dupuis (May 12)
- Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Michael Sierchio (May 12)
- Re: Pentester convicted.. Dotzero (May 12)
- Re: Pentester convicted.. etropos (May 11)
- RE: Pentester convicted.. Shane Warner (May 11)
- RE: Pentester convicted.. Kluge (May 12)