I have a problem with the "get it in writing" people. To me this is as dumb as it gets. Let me ask you one question about Penetration testing then let me give you an analogy.

Does a hacker send you a "letter of intent"?

Analogy:
If you work in a building where physical security is required and all the guards (IDS) watch the front door, you notice a backdoor entry where there are no guards. You walk through the back door without getting caught. Do you not bring this up to the guards because you didn't get it in writing?

Maybe I'm taking away the more anal justification for paperwork but that is a real issue.

You don't ask a guard to protect the facility and not provide them the tools (i.e. GUN). Why would you do the same with a IT Security Professional? (i.e. snifer, scanner, mapping, etc.)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/167/20525#20525