1

Is it bad practice and unprofessional to complete penetration tests from distant cities, without meeting your clients in person?

closed as off-topic by Neil Smithline, Steffen Ullrich, Xander, Iszi, TildalWave Dec 8 '15 at 18:05

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Neil Smithline, Steffen Ullrich, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    It is always recommended that before doing any such penetration testing, get it in written from the client. – roguesecurity Dec 8 '15 at 3:58
  • You must communicate with your clients, specifically to obtain authorisation, but there is no actual obligation to meet them personally. In large security companies, it would be rare for the testers to meet all clients, although they will have email or phone conversations with them. For a self-employed tester, it might be part of the personal service to meet them. – Matthew Dec 8 '15 at 9:44
  • You might want to tell your ISP that you're doing tests from wherever it is you'll be doing it – Arlix Dec 8 '15 at 11:51
  • We need more details about what you are asking about. As you can see, there is great confusion. What do you mean by "bad practice"? – schroeder Dec 8 '15 at 15:51
2

I'm attempting an answer based off of experience from coordinating pen tests for Fortune 100 companies. Unfortunately I think the answer is, "it depends" but hopefully this be helpful.

Is it bad practice and unprofessional to complete penetration tests from distant cities, without meeting your clients in person?

The first and most important thing to know is that you must have authorization to perform the penetration test. Whether face-to-face or remote, doesn't matter. This means a formal document from the client as well as from any 3rd party vendors. For example, if your client is using AWS (Amazon Web Services), then you must have written approval and authorization of the test as well as the scope of the test from not only the client but from AWS as well. Whether you do that face-to-face or remotely - doesn't matter - you had better have legal approval to perform the test.

When you coordinate this remotely, you might risk oversight of this important point.

As far as meeting your client in person, that depends on the client. Some clients want face-to-face, some don't care. But more than that, and as mentioned by GdD, expectations must be agreed before performing the test. This is usually provided in the form of scope, cost, and deliverables.

I'm just throwing this out as a bonus but clients should understand that the test is a snapshot in time. People, processes, and technology are an important part of the full lifecycle so just getting an A+ on a pen test is not proof that the client is "secure" for eternity.

1

The most important thing for a penetration test to be successful is that the client's expectations is clearly communicated to the tester. This can be done face to face or remotely. A face to face meeting can be very helpful in this, but it is not necessary and I've seen very good penetration testing done without meeting anyone from the testing organization because the requirements were communicated effectively. This was done by documenting the requirements and then calls over the phone to answer questions.

If the testers are a business rather than a single individual then you probably aren't going to meet the people who will perform the test anyway, you are more likely to meet a sales rep and sales staff while the "real work" may be done by a completely different set of people.

0

Please refer to below lines from http://www.pentest-standard.org/index.php/Pre-engagement#Rules_of_Engagement

"One of the most important documents which need to be obtained for a penetration test is the Permission to Test document. This document states the scope and contains a signature which acknowledges awareness of the activities of the testers. Further, it should clearly state that testing can lead to system instability and all due care will be given by the tester to not crash systems in the process. However, because testing can lead to instability the customer shall not hold the tester liable for any system instability or crashes. It is critical that testing does not begin until this document is signed by the customer."

Not the answer you're looking for? Browse other questions tagged or ask your own question.