6

When you hire someone/business to come in how can you be sure they won't have a rogue employee who will backdoor your systems? Is there a way you can trust anyone? How do big corporations do it? Seems with so many possible openings that the chance of someone going rogue is very possible.

Is it best to look into doing it yourself? Do you hire your own team so you can have a trust relationship?

Basically, what steps should be taken when giving someone legal rights to hack-test your systems and network?

Improve this question
11
  • 1
    Ask for references. Google the company first. Only hire someone with a good reputation.
    – Zoredache
    Aug 7, 2012 at 16:29
  • 5
    Don't hire from of Craigslist this sort of thing. :)
    – Aaron Copley
    Aug 7, 2012 at 16:40
  • 1
    @AaronCopley Also avoid guys named "Lefty" or "Fingers"... unless you're also doing a physical security test too.
    – voretaq7
    Aug 7, 2012 at 16:57
  • Hey, I'm a Lefty. >< ... Also, LOL'ing at my previous comment's bastardized sentence structure. My God... I'm impressed any one even understood what I wrote.
    – Aaron Copley
    Aug 7, 2012 at 17:09
  • The level of due diligence required really depends on what you are asking them to do and what information they will have access to. For example, if you can limit what information they need the better. Suggest you update the question with some more details about what exactly you are trying to accomplish? Server hardening, audit, pen testing, code audits, database audits? Is this against production, development or test systems?
    – jeffatrackaid
    Aug 7, 2012 at 18:26

4 Answers 4

Reset to default
7

Pay one of the big companies to do it - it doesn't prevent that kind of thing from happening but you do get a degree of protection by doing so.

Improve this answer
4

Basically, what steps should be taken when giving someone legal rights to hack-test your systems and network?

Have your company lawyer draw up a contract that takes away the reproductive organs of the contractor should they do anything shady with the data they acquire.
Such contracts usually include work-product clauses, non-disclosure agreements, and (to protect the contractor) an acknowledgement by your company that the penetration test is authorized and may result in outages/data loss.

Beyond that, a background check is a good start if you're hiring an individual.
If you know people in the pen-testing field you can always hire your friends (whom you presumably trust), otherwise hiring a large company like Chopper3 suggested is always an option (but be aware that many of these companies hire "reformed black-hats" because those are the folks with the skills).

Improve this answer
4

More or less the same way you'd evaluate any firm offering your company critical services - your same question could be put to lawyers, accountants, auditors, janitors, etc. Part of the selection process should involve reference checking (including criminal checks for employees) and confirmation that the appropriate levels of bonding and insurance are in place. A D&B (credit check) will also give a sense of how established the business may be. Finally, the nature of the contract between your company and your pen tester can define terms and penalties. Even with all of this it's important to make sure your business has appropriate levels of the right types of insurance - this is precisely the kind of thing that COO's and CFO's are supposed to be figuring out.

Improve this answer
1

When hiring a penetration tester:

  • Check their credentials & reputation
  • Get references
  • Check their current status. Are they falling apart and will they do something stupid?

Here's a guide to hiring penetration testers. Enjoy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .