2KKUU7ita

Chapter 18: Managing Security Processes
✓ Do you know exactly who will perform the tests? Will one person do
the testing, or will subject-matter experts focus on the different areas?
(This isn’t a deal breaker but is nice to know.)
✓ Does the provider have the experience to recommend practical and
effective countermeasures to the vulnerabilities found? The provider
shouldn’t just hand you a think report and say, “Good luck with all that!”
You need realistic solutions.
✓ What are the provider’s motives? Do you get the impression that the
provider is in business to make a quick buck off the services, with minimal
effort and value added, or is the provider in business to build loyalty
with you and establish a long-term relationship?
Finding a good organization to work with long term will make your ongoing
efforts much simpler. Ask for several references and sample sanitized deliverables
(that is, reports that don’t contain sensitive information) from potential
providers. If the organization can’t produce these without difficulty, look for
another provider.
Your provider should have its own service agreement for you that includes a
mutual nondisclosure statement. Make sure you both sign this to help
protect your organization.
Thinking about hiring a reformed hacker?
Former hackers — I’m referring to the black-hat
hackers who have hacked into computer systems
in the past — can be very good at what
they do. Many people swear by hiring reformed
hackers to do ethical hacking. Others compare
this to hiring the proverbial fox to guard the hen
house. If you’re thinking about bringing in a
former unethical hacker to test your systems,
consider these issues:
✓ Do you really want to reward malicious
behavior with your organization’s business?
✓ Claiming to be reformed doesn’t mean he or
she is. There could be deep-rooted psychological
issues or character flaws you’re going
to have to contend with. Buyer beware!
✓ Information gathered and accessed during
ethical hacking is some of the most sensitive
information your organization possesses. If
this information gets into the wrong hands —
even ten years down the road — it could
be used against your organization. Some
hackers and reformed criminals hang out
in tight social groups. You might not want
your information shared in their circles.
That said, everyone deserves a chance to
explain what happened in the past. Zero tolerance
is senseless. Listen to his or her story and
use common-sense discretion as to whether
you trust the person to help you. The supposed
black-hat hacker actually might have been
a gray-hat hacker or a misguided white-hat
hacker who fits well in your organization.
335