2

I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have requested details regarding our network including; network setup, intranet, What data should be provided to them? and what data should not provided?

Improve this question

1 Answer 1

Reset to default
2

Given that the penetration testers have a limited amount of time (since you provide them with a limited amount of money) they can do a better job in that time the more information they have from start. Thus, if you are interested that they actually help you to increase your security you better give them all the details they want.

If instead you want to have a result which says that they did not find much in the time they had, then make their job as hard as possible and provide no information at all. But while such result might look good in a management report it will likely not reflect the true (in)security of your network.

Improve this answer
3
  • Thank you so much for your advices, but i have no problem with time, therefore i requested to do blackbox testing. But they requested even network diagram. Please tell me should i provide that much of details for black box testing
    – Infra
    Dec 12, 2018 at 7:54
  • 1
    This is a classic problem. One could argue that giving up front info doesn't demo a true 'black-box' test. Related issue is when a tester requests that the FW be turned off so that a 'true representation of your network state' can be achieved. If your system was under concerted, targeted attack by a malicious actor, they effectively have 'inifinite' time to map your network. If you feel such info would be eventually discerned, you're losing nothing by giving the tester a leg up. You of course want the tester to spend their time effectively and thus analyse your priorities for the test.
    – user53693
    Dec 12, 2018 at 11:08
  • @RuwanPradeep: "..i have no problem with time..." - so you have no problem that they spent lots of time in your network and charge you lots of money for this? And if they need more time than initially agreed on you will simple give them more time and money? That's unusual or you must have really cheap penetration testers (which are likely not worth the money then). If it is in your interest that they can do their job best to find problems in your network then provide them with the data they requested.
    – Steffen Ullrich
    Dec 12, 2018 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .