Re: Pen Testing

[Matt - MRS Security <matt () mrssecurity com>]

Patrick Fitzgerald wrote:
> Does anyone know of a pen testing company named Sklar Technology
> Partners, whether it be positive or negative? What should we be
> looking for in a security company? Is it common that a security
> company would need rights such as domain admin rights to perform an
> audit on the network? Any resources that you could suggest would be
> helpful.
>
> Thank you.
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Security Trends Report from Cenzic
> Stay Ahead of the Hacker Curve!
> Get the latest Q2 2008 Trends Report now
>
> www.cenzic.com/landing/trends-report
> ------------------------------------------------------------------------
>
>   
Hi,

Usually if we cannot obtain domain admin credentials during testing then 
we do request them i.e. create a new domain admin user specifically for 
us with a strong password and delete at end of testing.

This is normally to obtain patch listings to add to reports and that is all.

Usually you do not require to hand out credentials; its at your discretion.

Matt.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------