Penetration Testing mailing list archives
Re: Pen Test Contracts
From: Christine Kronberg <seeker () shalla de>
Date: Thu, 13 Jul 2006 13:10:39 +0200 (CEST)
Hi Rob,
I am curious if anyone happens to have a few documents that may assist me. I am not looking to re-create the wheel and would appreciate any help.I am looking for a few templates that I can use for (of course I would modify them to reflect my organizations):1. Internal Approval for penetration testing. This is the type you would use to gain written approval from your internal management to perform penetration testing on your own network.2. Customer Approval Contract for External Penetration Testing - This form is used for getting written approval from your customers to perform penetration testing on their networks. This usually will include the scope and any guidelines for the engagement of the pen-testing activities.
Why do you make an distinction between the approval for internal and external (customer side) pen testing? For an internal test management is the customer. For the contract you may take a look at: www.professionalsecuritytesters.com
3. Proposal. If anyone has a example of a proposal for costing information for different services.
The costs rely entirely on time and effort. A simple portscan is (no pentest and) easily archieved. The verification of the results take some more time (and knowledge), yet this is usually not some- thing expensive. In case of penetration tests you can try this kind of rough calculation: * assumption: network with 20 clients * assumption: each client offers 10 services => that make 200 examinations an on: * assumption: each examination takes 15 minutes. * assumption: the working day has 8 hours. => that makes 6,25 days of work. Now use your daily rate to estimate the costs and don't forget the time you need to write and present your report. Of course, 15 minutes for an examination is ... not very much, if you do your job properly. So the testing, even with support of automized tools, will not be very deep. And don't forget there is still the time it takes to verify your data. But this little example gives an idea about the costs and why a penetration test can be very, very expensive. Have a nice day, Christine Kronberg. ------------------------------------------------------------------------------ This List Sponsored by: CenzicConcerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------
Current thread:
- Pen Test Contracts rkraus (Jul 12)
- Re: Pen Test Contracts Christine Kronberg (Jul 13)
- RE: Pen Test Contracts Robert J. Kraus (Jul 13)
- RE: Pen Test Contracts Richard Feist (Jul 13)
- RE: Pen Test Contracts Robert J. Kraus (Jul 13)
- <Possible follow-ups>
- RE: Pen Test Contracts David M. Zendzian (Jul 12)
- Re: Pen Test Contracts Christine Kronberg (Jul 13)