Tag Info

New answers tagged

0

How mature is the clients cyber security program? If the customer has never had a penetration test before, they have little to gain from an unannounced test. In this case things should be very collaborative and open. If however the customer has their own fully staffed SOC (Security Operations Center) that regularly detects and responds to threats, a pentest ...


1

Speaking of isolated pentesting, compartmentalisation is your friend. It's always good if someone knows what you're up to. Could be the Board, CEO, CSO, ICT director, or any other lower management but people that are going to be pentested should not be informed if you want to observe genuine reactions. There are some cons though, mostly if your testing is ...


0

Here's two factors against announcing: A real attacker who is a user but was waiting for the most opportune moment for the attack (or not sure whether to attack at all), may just find the opportune moment in an announced pentest, when it becomes normal-ish for unusual things to happen. People who would otherwise gleefully grant access to restricted assets ...


0

The factors are largely one of trust, and risk. Do you trust that people won't go and suddenly add in new security that didn't exist before? Trust is incredibly important in security, and generally under-appreciated in the IT community. Trust between the security department and the rest of the company makes everyone's job easier. When people trust you, ...


1

SilverlightFox, I feel that there are 3 main points one must keep in mind when disclosing a penetration test to personel: What systems are you targeting? - The most important because depending on what is in scope, technicians for these services might need to made aware so that they can prepare and remediate any issues that arise. What are the laws and ...


2

For me the answer to this question largely revolves around the type of testing being undertaken. If you have a "proper" penetration test where the testers are simulating an attack, a decent quantity of the benefit of the test is seeing how/whether the attack is noticed and how the internal users/IT react (e.g. do they report it to the helpdesk if something ...


0

Considering the impact of an actual penetration by malicious parties (which is very high for most modern businesses), the best practice would be to do pen tests only as part of a much larger scope of action on penetration countermeasures. For example, the first pen-test you do might be fully notified. You can then record any objections, and perhaps even ...


1

One crucial thing is to refer to the company's Information Security Policy. These policies will also decide what an employee is allowed and not allowed to do in the company with aspect of IT security. It also decides what will be the penalty if an employee breaches a security policy. So for eg: if the policy says that the company can monitor any one any ...


1

That mainly depends on whether the user should know of the test. Of course, since you're simulating a real attack, you may or may not tell them, where comes the dilemma of things users would do. It's just that you should inform all those users for whom you are not testing the preparedness of attack. That's safe enough, because real attacks can come anytime ...


4

In the UK, law is a strong factor. The Human Rights Act 1998 states: Everyone has the right to respect for his private and family life, his home and his correspondence. So if any users that are caught up in the penetration test have an "expectation of privacy", then you are required by law to inform them prior to any testing. Note that just because ...



Top 50 recent answers are included