The days when people had a sense of humor about people taking over their systems are gone. Think of it like this - if someone pen-tested your house without warning, and you caught them wandering around your living room talking about how they were trying to help make your house more secure, you'd have them arrested, assuming you didn't do worse. If you're going to pen test something, better be sure you have permission from the owner.

Another consideration - I've done a lot of pen testing, and it is common to knock stuff over. A simple test for SQL injection can put a server in an infinite loop. Having stuff knocked over is annoying and costs money.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/481/35209#35209