0

Recently I conducted a penetration testing where I used the following text as authorization:

Penetration testing authorization

During a penetration testing is possible that:

  • The performance of servers and networks is decreased.
  • Lost of availability of some services.
  • Access to confidential data.
  • Modification of web site.
  • Physical access to private zones.
  • Employees suffer social engineering attacks.

I acknowledge these risks and authorize yzT to perform a penetration testing in my company.

John Doe, CEO of Some Random Company Inc.

(Signature and date)

Is this right? Or should I add another information in future jobs?

2

The right answer is: get a lawyer and make it airtight. When it comes to legal documents it's the same as with crypto:

Don't roll your own!

Generally these things are 10-pagers offloading the (financial) liability to the client if things go wrong. Currently you just make the CEO accept the risks but you do not offload the liability back to them.

Every company also has their rown procedures and will also have other requirements such as and can't be done with the result of the pentest. These documents are quite vast and different for each penetration test.

Also more specifically social engineering can become a gray zone when it comes to segregation of professional and private life. Especially in more privacy minded countries (EU countries mostly) this can be very tricky to offload back to the client.

-2

you should edit the "loss of services" line to "temporary loss of services"

alas, in my view the rest of the text is clearly explained and there's no grammatical mistakes. great work!

  • Actually he shouldn't. It wouldn't be the first time a service is taken down or permanently due to severe data loss and no backups. – Lucas Kauffman Jul 2 '14 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.