I think this is one of the dumbest things I ever read on Security Focus (and there have been some real gems published here over the years). For this to come from a university professor is even more laughable.

How do you know that the Carlton student wasn't acting malicious, and then became paranoid that he might have been discovered and cooked up the "16 page report" to cover himself? That to me is more likely than someone breaking in as a "Good Samaritan" without prior approval to run the test.

I think the lesson is if you're concerned about the security of your school's network, or the network of some arbitrary company - get permission to run the pen test. Why anyone would be that bored to want to improve the security of "Company X" is beyond me.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/481/35161#35161