Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When you hire someone/business to come in how can you be sure they won't have a rogue employee who will backdoor your systems? Is there a way you can trust anyone? How do big corporations do it? Seems with so many possible openings that the chance of someone going rogue is very possible.

Is it best to look into doing it yourself? Do you hire your own team so you can have a trust relationship?

Basically, what steps should be taken when giving someone legal rights to hack-test your systems and network?

share|improve this question
    
Ask for references. Google the company first. Only hire someone with a good reputation. –  Zoredache Aug 7 '12 at 16:29
4  
Don't hire from of Craigslist this sort of thing. :) –  Aaron Copley Aug 7 '12 at 16:40
    
@AaronCopley Also avoid guys named "Lefty" or "Fingers"... unless you're also doing a physical security test too. –  voretaq7 Aug 7 '12 at 16:57
    
Hey, I'm a Lefty. >< ... Also, LOL'ing at my previous comment's bastardized sentence structure. My God... I'm impressed any one even understood what I wrote. –  Aaron Copley Aug 7 '12 at 17:09
    
The level of due diligence required really depends on what you are asking them to do and what information they will have access to. For example, if you can limit what information they need the better. Suggest you update the question with some more details about what exactly you are trying to accomplish? Server hardening, audit, pen testing, code audits, database audits? Is this against production, development or test systems? –  jeffatrackaid Aug 7 '12 at 18:26

4 Answers 4

up vote 6 down vote accepted

Pay one of the big companies to do it - it doesn't prevent that kind of thing from happening but you do get a degree of protection by doing so.

share|improve this answer

Basically, what steps should be taken when giving someone legal rights to hack-test your systems and network?

Have your company lawyer draw up a contract that takes away the reproductive organs of the contractor should they do anything shady with the data they acquire.
Such contracts usually include work-product clauses, non-disclosure agreements, and (to protect the contractor) an acknowledgement by your company that the penetration test is authorized and may result in outages/data loss.

Beyond that, a background check is a good start if you're hiring an individual.
If you know people in the pen-testing field you can always hire your friends (whom you presumably trust), otherwise hiring a large company like Chopper3 suggested is always an option (but be aware that many of these companies hire "reformed black-hats" because those are the folks with the skills).

share|improve this answer

More or less the same way you'd evaluate any firm offering your company critical services - your same question could be put to lawyers, accountants, auditors, janitors, etc. Part of the selection process should involve reference checking (including criminal checks for employees) and confirmation that the appropriate levels of bonding and insurance are in place. A D&B (credit check) will also give a sense of how established the business may be. Finally, the nature of the contract between your company and your pen tester can define terms and penalties. Even with all of this it's important to make sure your business has appropriate levels of the right types of insurance - this is precisely the kind of thing that COO's and CFO's are supposed to be figuring out.

share|improve this answer

When hiring a penetration tester:

  • Check their credentials & reputation
  • Get references
  • Check their current status. Are they falling apart and will they do something stupid?

Here's a guide to hiring penetration testers. Enjoy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.