Pen tester revealing users information for company

Question

In my company, the network administration team decided to make penetration testing, and used a freelancer IT for it.

During the process, he was able to reveal many usernames and passwords which weren't protected very much 'http urls, basic authentication proxy, ... etc.'

Is it okay to hand this information and any other user-related and private info to the admins, and what should I do as a normal user to avoid that kind of privacy violation.

P.S: maybe the whole penetration testing is for 'hacking' users privacy, which makes it much worse.

Answer 1

I believe it is okay to hand out user information as long as it is clearly related to the user's work in the company and to the company's security. I as an employer would like to know if there are employees which use weak passwords, etc. because this clearly affects the security of the corporate IT.

Social media accounts of users have clearly nothing to do with the user's work at the company. The fact that you work at company X doesn't authorize your manager at company X to hack your facebook account, pretty much like it doesn't authorize your manager to break into your appartment and see what you are doing there.

There is a grey area, though, which I believe is pretty relevant: If users use the same passwords for the business and their personal accounts then this can be relevant for the company's security and I as a responsible would want to know about that. Therefore I can understand why you were asked to also hack the social media accounts, even if it is more than obvious that this is not the correct way to address this problem.

Answer 2

Your admins probably already have access to these informations. They probably have root access to everything. You already have to trust them. If you don't, run.

Answer 3

Well the main thing to worry about with pen testing is probably trust. You would't hire a lawyer you don't trust, you would't go to an hospital you don't trust and you shouldn't hire a pen tester you don't trust.

The pen tester has access to potentially harmful information and that's his job to get to try to retrieve that information from you system. And that's also his job to not use or share that information. That the same kind of professional secrets that a lawyer or a doctor would deal with. I don't think it's a good idea to limit access of the pen tester. The point of pen testing is to test the most important systems, with the most important secrets and guarantee that those important secrets are safe. So at one point they have test those systems and it's completely possible that they find a way to get access to it. It would be ridiculous to ask a pen tester to test only the part of the system that doesn't contain any secret or to test a separate system with fake data that wouldn't be 1:1 identical, because they wouldn't be able to test the mis-configurations of the real system.

You shouldn't worry about the kind of information they can get access to, you should be worry about whether or not you can trust your pen tester.

The hard part is to determine how to calculate this "trust". Reputation can help, but I believe that this is mostly opinion-based...

---

Complementary answer about admins:

It's of course really bad if you can't even trust your own admins since they basically have access to everything, or at least have full access to part of your system. (koff Snowden koff koff) But there is at least one thing you can do: For very sensitive data like bitcoins for exemple, hashicorp's vault (don't like to recommends product but I don't know any alternative) can allow access to some services only if multiple admins sign in. There is far less chances that multiple admins would coordinate to steal your data than a lone wolf. You can read on this and on more ultra-paranoid security set-up here: https://medium.com/the-coinbase-blog/how-coinbase-builds-secure-infrastructure-to-store-bitcoin-in-the-cloud-30a6504e40ba#.uzjtngr1x

You can also seperate your system in multiple sub-systems, limit access to each individual admin to the strict minimum.

You can also try to monitor everything for suspicious admin activities. (what does a suspicious admin work looks like?)

But at some point, whatever you do, your admins still have more power than most employees and you still have to trust them in some level.

---

Complementary answer about unskilled admins:

Expecting your admin to not have the skill to hack you is not a good protection. In your threat model you should consider what they have access to everything they can access whether or not this access can be difficult. You know hacking is hard, does it mean that you can let an extraordinary hard-to-exploit security bug unpatched? Of course not!

Considerate that your admin has easy access to whatever it has access to.

Is that a problem? Can you trust your admin to deal with that data?

Yes: no problem No: replace your admin, add supervision from a more trusted admin, double verification with Vault or whatever.

Your admin has more access than the pen tester, if you trust your pen tester more than your admins, there is something very wrong.