This question was primarily inspired by this (related) question, but is about the other side of the equation.
I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a penetration test (unbeknownst to me). John successfully got into our building and made it all the way up to our floor. He got someone to let him in and gained access to a relatively secure area.
Unfortunately for John, his presence in the secure area triggered an alarm which dispatched me to investigate. I found John in our server room, where he was about to plug something in to one of our network switches.
I managed to stop him before he connected his computer to our switch, and demanded to know what he was doing there in a secure area. He presented me with a Permission to Attack slip which did not check out, followed by a real Permission to Attack slip that was confirmed with the relevant party.
Right now, I have a hacker sitting
handcuffed to a chair in the server room, not allowed to leave my sight until I know what to do with them.
So, what do I do with them? There are a few options I can think of:
- Escort them out of the building,
- Just politely tell them to leave the premises as the penetration test has concluded,
- Let them keep doing whatever it was they're doing and hope our NOC catches them too
My company doesn't have any policy guidelines I should follow and the person on the PtA form doesn't know either, so I'd like to know what's considered the best-practice in a situation like this.