Brief response

Most contracts between security consulting companies and thier clients limit to some extent the liability of the consultant (they are a consultant, not an insurere), but the short answer is, if a security provider screws up, they probably can be sued - depending on the circumstances and what they did.

As to the "authorized" commands (requests), certainly a good argument. When I type a URL I "request" the host to deliver the HTML. When I turn a doorknob, do I "requst" the door to open? Push/pull - hard to say.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/463/34882#34882