2KKUU7ita

36
Part I: Building the Foundation for Ethical Hacking
If you’re an independent consultant or have a
business with a team of ethical hackers, consider
getting professional liability insurance
(also known as errors and omissions insurance)
from an agent who specializes in business
Do you need insurance?
Establishing Your Goals
You can’t hit a target you can’t see. Your ethical hacking plan needs goals.
The main goal of ethical hacking is to find vulnerabilities in your systems so
you can make them more secure. You can then take this a step further:
✓ Define more specific goals. Align these goals with your business objectives.
What are you and the management trying to get from this process?
What performance criteria will you use to ensure you’re getting the most
out of your testing?
✓ Create a specific schedule with start and end dates as well as the times
your testing is to take place. These dates and times are critical components
of your overall plan.
Before you begin any ethical hacking, you absolutely, positively need everything
in writing and approved. Document everything and involve management
in this process. Your best ally in your ethical hacking efforts is a manager who
supports what you’re doing.
The following questions can start the ball rolling when you define the goals
for your ethical hacking plan:
✓ Does ethical hacking support the mission of the business and its IT
and security departments?
✓ What business goals are met by performing ethical hacking? These
goals may include the following:
• Prepping for the internationally accepted security standard of ISO/
IEC 27002:2005
• Working through Statement on Standards for Attestation
Engagements (SSAE) 16 audits
• Meeting federal regulations such as HIPAA, SOX, or PCI DSS
• Meeting contractual requirements of clients or business partners
• Maintaining the company’s image
insurance coverage. This kind of insurance can
be expensive but will be well worth the expense
if something goes awry and you need protection.
Many customers even require the insurance
before they’ll hire you to do the work.