Re: Limited vs full blown testing

[Martin Mačok <martin.macok () underground cz>]

On Wed, Jun 23, 2004 at 09:27:58AM -0700, Toby Barrick wrote:

> During my many years of pen testing one common thread when dealing
> with customers has been the request to not perform any destructive
> or DOS type testing.

Tell them that the purpose of the test is *to test* (i.e. to try
something) and the only thing you can do to not break anything is to
not try anything at all. Maybe they want an audit instead of
a pen-test and they just don't know the terms and the meanings.

If they are so scared, negotiate the exact time of potentially
destructive/aggressive tests.

Use Nessus with "safe checks" turned on for "polite" scans... You can
also disable all "DoS" family plugins in Nessus.

Martin Mačok
IT Security Consultant