>Pen testers should have the client detail exactly the scope and extent of the network to be tested -- a range of IP addresses, domains, or physical locations.

But what if you do a WiFi-drive-by test on Bob's network (with permission) and Alice's network next door is vulnerable too? Alice never gave permission, but due to her poor security you might now be liable for damages to her network....

So, for tests of this nature you'd have to get permission from everybody and his brother/sister before doing a pen test, since you never know what you might hit upon.

Impossible and impractical. Good bye pen tests.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/167/20480#20480