Penetration Testing

[Steve Workings]

One of my apps/customers is nearing a penetration test. I've never been through this before. Negotiations are underway about the details. What caused me to pause and post here was this: The testing company wants a login and a waiver against damages of any kind.

This is mostly understandable - the user most likely to cause damage is one with login creds - whether he/she should have them or not. And it seems fairly standard to waive any damage claims.

In these days of internet searches I feel fairly informed on the subject, but wonder if anyone's been through this and most particularly if you (a) gave them keys to the door and (b) agreed not to hold them liable for any damage?

I'm comfortable our app is in good shape for this, but still want to do what I can to protect our interests

Thanks for any comments

[Peter.Greulich]

Re: Penetration Testing

I don't know. To me it sounds like this is the point where you need to speak to an attorney.

[frankbicknell]

Re: Penetration Testing

I'd say common sense should be the rule here.

[scrimej]

Re: Penetration Testing

Damages? It is an app and data, back both up and get the test. If something goes wrong it would be better to find out in a controlled situation rather than a legitimate hack.

I had one done before, not with Alpha as the source code but something else. They found a minor error and I worked with the Vendor to plug the vulnerability.

[Steve Workings]

Re: Penetration Testing

Overall I'm with Jeremy on this. But, this is a SAAS application with many clients all with data that is treated and viewed to near-HIPAA standards. We're taking steps to insure that the testing company behaves appropriately. This test is being ordered and paid for by a very large new client so we don't have the same control as if we were hiring the testing.

[Pat Bremkamp]

Re: Penetration Testing

Can you create a VM and copy the app there? Like a phase 1 test. If that shows anything, then fix that before the full blown test. Your other clients would be happier with this also.

[Steve Workings]

Re: Penetration Testing

Pat - our client is paying a contractor for the test. So, we don't know much about their methods, tools, plan, etc. and wouldn't be able to run a pre-test trial. We may learn a little more as we get closer to the event. I'm hoping and kind of expecting it'll be a "non-event".

[jgrannis]

Re: Penetration Testing

I've been through a few of these and although they get you to sign the agreements, I have found that they know what they are doing. Being experts, they definitely know enough to not carry out any damaging or very intrusive actions.
For instance, if they see a weak point in the system that is open to a brute force attack, they usually just tell you about it. They don't need to prove it to you and are confident enough with what they found to be able to explain it rather than actually carrying out the attack.
It is a penetration test after all; not a stress test.

I have never given them any type of account login information though. And especially not some sort of super-user account info. They would usually create an account like any other user and see what they can do with it. They would work with me though and call me, for example, when they were about to confirm an eCommerce order that I would then make sure doesn't get fulfilled. If they couldn't get me on the phone, they would postpone that part of the test.

Most of the time, I could find no indication that they were even trying to penetrate the system.

EDIT: Come to think of it... they also had us get our infrastructure hosting service to sign an agreement so that they would not be surprised by suspicious activity and over-react by shutting systems down. I actually would not work with security experts if they did not have you sign some agreements.