Re: Need Some Guidance Please

[Michael Boman <michael.boman () gmail com>]

On Sat, Apr 18, 2009 at 9:14 PM, Micheal Cottingham
<techie.micheal () gmail com> wrote:
> Also, I have to disagree on the penetration tests causing trouble
> because people weren't notified. Done right and responsibly, those who
> need to know will know about the testing will be notified. Part of the
> point of testing is that those who are monitoring the servers/network
> need to be "out of the loop" so when they see malicious activity, they
> can respond to it as they would for any other incident. If for example
> they know I'm coming, chances are pretty good that they will react
> differently than if they did not know I was coming. As an auditor/pen
> tester, I don't want that. I want to know that if I do something, the
> people I'm trying to help will have the ability through their network
> monitoring to respond to incidents. So when it is the real thing, they
> know what to do and do it quickly and accurately.

Some additional tips. If you end up doing pentest for a very small
shop where the operational people are the same as it management
people, you can still archive sort of the same result by giving the
target organization  a very large time frame in which you will conduct
the work. I have been giving shops 2 months time frame to spend no
more then 2 weeks of work on (I, like most consultants, charge for
time spent - not for the calendar time) - that way they at least need
to stay on their toes for 2 months, and hopefully got into the habit
of doing it from there on.

Best regards
Michael Boman

-- 
http://michaelboman.org - Security Blog & Wiki

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Tired of using other people's tools? Why not learn how to write your own exploits? 
InfoSec Institute's Advanced Ethical Hacking class teaches you how to write stack and heap buffer overflow exploits for 
Windows and Linux. Gain your Certified Expert Penetration Tester (CEPT) cert as well. 

http://www.infosecinstitute.com/courses/advanced_ethical_hacking_training.html
------------------------------------------------------------------------