2 added 11 characters in body
source | link

There are a few drawbacks to hiring a hackerblackhat "hacker" instead of a security company.

They are harder to trust

Apart from backdooring your system, I would not trust a blackhat I pick off the street to keep his findings about my network confidential. Hackers like to boast to their peers. The knowledge they obtain about your security can bite you in the ass in more than one way.

They are adrenaline junksjunkies

OK, that's a bit strong. But a hacker who is just in it for the fun and not for the money, will focus on what he finds fun. I have worked with both professional penetration testers and ``recreational hackers''"recreational hackers", and the latter kind performs a different kind of test. If you find yourself a good hacker, he may have more knowledge than the professional penetration tester, but he will not deliver the same quality report. He will find a fun way to enter your network and exploit that fully, while the penetration tester will see if there are multiple ways in, will weigh the issues he finds against the actual risk, and can give you a less black-and-white advice about how to solve the issues.

They are harder to do business with

Think in terms of planning, deadlines, availability for status updates et cetera.

So, if you find yourself the perfect gentleman hacker with knowledge of the underground, who will keep your findings confidential, propose realistic solutions, and do the test from the perspective of what is useful to you instead of just what is fun for him, then you have a winner. Good luck finding him :-)

By the way, if you already have a security company you hire for regular penetration tests and such (which imho a big company should have), then hiring some hackers for an ``extra'' test to see if the company misses anything, can be a great move. The confidentiality issue stays though...

There are a few drawbacks to hiring a hacker instead of a security company.

They are harder to trust

Apart from backdooring your system, I would not trust a blackhat I pick off the street to keep his findings about my network confidential. Hackers like to boast to their peers. The knowledge they obtain about your security can bite you in the ass in more than one way.

They are adrenaline junks

OK, that's a bit strong. But a hacker who is just in it for the fun and not for the money, will focus on what he finds fun. I have worked with both professional penetration testers and ``recreational hackers'', and the latter kind performs a different kind of test. If you find yourself a good hacker, he may have more knowledge than the professional penetration tester, but he will not deliver the same quality report. He will find a fun way to enter your network and exploit that fully, while the penetration tester will see if there are multiple ways in, will weigh the issues he finds against the actual risk, and can give you a less black-and-white advice about how to solve the issues.

They are harder to do business with

Think in terms of planning, deadlines, availability for status updates et cetera.

So, if you find yourself the perfect gentleman hacker with knowledge of the underground, who will keep your findings confidential, propose realistic solutions, and do the test from the perspective of what is useful to you instead of just what is fun for him, then you have a winner. Good luck finding him :-)

By the way, if you already have a security company you hire for regular penetration tests and such (which imho a big company should have), then hiring some hackers for an ``extra'' test to see if the company misses anything, can be a great move. The confidentiality issue stays though...

There are a few drawbacks to hiring a blackhat "hacker" instead of a security company.

They are harder to trust

Apart from backdooring your system, I would not trust a blackhat I pick off the street to keep his findings about my network confidential. Hackers like to boast to their peers. The knowledge they obtain about your security can bite you in the ass in more than one way.

They are adrenaline junkies

OK, that's a bit strong. But a hacker who is just in it for the fun and not for the money, will focus on what he finds fun. I have worked with both professional penetration testers and "recreational hackers", and the latter kind performs a different kind of test. If you find yourself a good hacker, he may have more knowledge than the professional penetration tester, but he will not deliver the same quality report. He will find a fun way to enter your network and exploit that fully, while the penetration tester will see if there are multiple ways in, will weigh the issues he finds against the actual risk, and can give you a less black-and-white advice about how to solve the issues.

They are harder to do business with

Think in terms of planning, deadlines, availability for status updates et cetera.

So, if you find yourself the perfect gentleman hacker with knowledge of the underground, who will keep your findings confidential, propose realistic solutions, and do the test from the perspective of what is useful to you instead of just what is fun for him, then you have a winner. Good luck finding him :-)

By the way, if you already have a security company you hire for regular penetration tests and such (which imho a big company should have), then hiring some hackers for an ``extra'' test to see if the company misses anything, can be a great move. The confidentiality issue stays though...

1
source | link

There are a few drawbacks to hiring a hacker instead of a security company.

They are harder to trust

Apart from backdooring your system, I would not trust a blackhat I pick off the street to keep his findings about my network confidential. Hackers like to boast to their peers. The knowledge they obtain about your security can bite you in the ass in more than one way.

They are adrenaline junks

OK, that's a bit strong. But a hacker who is just in it for the fun and not for the money, will focus on what he finds fun. I have worked with both professional penetration testers and ``recreational hackers'', and the latter kind performs a different kind of test. If you find yourself a good hacker, he may have more knowledge than the professional penetration tester, but he will not deliver the same quality report. He will find a fun way to enter your network and exploit that fully, while the penetration tester will see if there are multiple ways in, will weigh the issues he finds against the actual risk, and can give you a less black-and-white advice about how to solve the issues.

They are harder to do business with

Think in terms of planning, deadlines, availability for status updates et cetera.

So, if you find yourself the perfect gentleman hacker with knowledge of the underground, who will keep your findings confidential, propose realistic solutions, and do the test from the perspective of what is useful to you instead of just what is fun for him, then you have a winner. Good luck finding him :-)

By the way, if you already have a security company you hire for regular penetration tests and such (which imho a big company should have), then hiring some hackers for an ``extra'' test to see if the company misses anything, can be a great move. The confidentiality issue stays though...