Summary: How to go about looking for a pen-tester

["Ershad Shafi Chowdhury" <iru () bol-online com>]

Greetings! Many thanks to those that responded. As it is traditional and
polite, I am writing a summary of the replies.

HOW TO GO ABOUT FINDING A SUITABLE PEN-TESTER:

1. Get references from your friends in the same industry. This will help
short-list the companies you can trust. If you still aren't certain just go
with a big well known firm.
2. Hire a consultant if necessary and define the scope of work to the
Pen-testers. I'd say both an internal and external audit should be done. You
should ask the pen-testers for suggestions.
3. Go over their terms and conditions carefully. As with any TOS, have your
lawyer review it, and discuss anything you don't like with the Pen-testing
company. Good thing to have is a second audit after recommended changes are
made.
4. Ask the company for details on the consultants who will be carrying out
the work. Although it does not prove anything, a Certified Information
Systems Security Professional (CISSP) would probably be a good idea.
5. Ask the company about bonding and Insurance. If they don't have a clue,
dump 'em.
6. It is blatantly obvious to us that a pen-test covers the system only at
the time of testing. Any pen tester that says otherwise is out of his mind.
But, the customer may think, kewl, had only one hole, its fixed, and I am
secure. If the pen-tester assures you that there are no worries once the
test is complete, thinking you are not smart enough, then run. In fact, if
the pen-tester suggests anything ridiculous or questionable, back off. You
may be wrong, but don't risk trusting your companies secrets to anyone if
they try to scare you in to hiring them, or if they make unrealistic claims.
7. Implement the changes as suggested by the pen-testing report. Audit your
network again by the same pen-tester, if everything goes well, there won't
be any major issues. If there are issues, keep on fixing the holes and
repeat the audit, until there are no issues.
8. If you are paranoid, now go  and find a second pen-tester and have
another audit done. This will give you a useful second opinion.


That's all for now, many thanks to kevin,steve,modify,hellnback,etaoin and
others.