4

I am currently finishing university and I am looking for work as a penetration tester. How important is it to have legal insurance for me in Germany and do I need to organise this privately.

Of course, I will always have a written contract from the company under test! However, not all employees will be aware of the test going on.

Given this job, how important is it to have legal insurance? And can I expect that my employer will cover this, or should I get one myself? I am from Germany.

I am asking before I sign the contract, because the insurances I have seen all have the first three months as a "warm-up time" during which they don't cover legal disputes?

How advisable is it generally for an employee/citizen to have legal insurance?

Improve this question
  • 2
    What employees know or don't is irrelevant. As long as their boss has signed a piece of paper that says icehawk can pwn us to his heart's content, subject to the following: you're golden. The only thing to worry about is attacking privately owned equipment that happen to be connected to the company network, ie. someone's iThingy that happens to be charging at a USB port, or connected to the wireless. Your contract should spell out how to proceed at that point. – rath Dec 13 '15 at 14:27
  • 2
    Actually since that privately owned device hooked up to company owned property could be a vector, scanning it would be part of the penetration test – mhoran_psprep Dec 13 '15 at 15:57
  • @mhoran_psprep the employee would need to have approved to that in some contract however if it goes beyond standard nmap style scanning – Natanael Dec 14 '15 at 1:41
  • This question is really specific and looks more like a legal question than a security question. – schroeder♦ Dec 14 '15 at 4:25
5

It depends on whether or not you are a full time employee of a "consulting company" or if you are an independent contractor.

Let's say company WeHaveHoles AG wants their security tested.

In the first case, they hire the company WeTestSecurity AG. WeTestSecurity AG hires you as a full time employee. You don't need any special insurance - your employer does.

In the second case, WeHaveHoles AG contracts with you independently to test their security. You will probably want "Errors and Omissions" insurance to cover you in case you make a mistake and accidentally damage them.

Improve this answer
  • 1
    If in doubt, ask an insurance specialist (Versicherungsfachmann) what type of insurance you need. They can be found in every city and their service is usually free - they get a commission if you actually buy insurance through them. – Sumyrda - remember Monica Dec 13 '15 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.