From: Dotzero (dotzero@gmail.com)
Date: Mon Mar 05 2007 - 14:51:51 EST
The original question from Barry was about legal vs illegal. There is
only one (IMHO) answer to that question. It depends on jurisdiction.
The laws that apply in one jurisdiction may not apply in another.
I'm also concerned about Barry asking about when others "approach a
client" to tell them about their insecurities following a "simple
pen-test".. They are NOT your client unless they have engaged you.
They are a potential client. They have no relationship with you and
you have not been authorized by them to do anything on their behalf.
Even if you haven't done anything illegal, most companies I'm familiar
with would be unlikely to hire you or your company under such
circumstances. The actions you describe are indicative of a failure to
recognize appropriate boundaries.
A more reasonable approach (and one more likely to attract business)
would be to have your sales people pitch a free security assessment.
Have a standard agreement authorizing a standard but limited set of
activities that you can then use to show a potential client how they
might benefit from your services.
As usual, just my 2 cents.
dotzero
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:38 EDT