mailing list archives
[PEN-TEST] Legalities and Liabilities
From: Ben Lull <blull () VALLEYLOCAL COM>
Date: Tue, 12 Sep 2000 11:42:53 -0700
I have some questions regarding the legal aspects of penetration
testing (I'm hoping this hasn't be answered on the list before,
I haven't had time to keep up for the past couple of weeks).
1.) Before a pen/sec test takes place, what type of legal documentation
should be obtained (disclaimers, limitation of liability, etc..)?
2.) What are major topics that should be discussed and included in a
contract between the pen/sec company and their client? Should a
contract even be written up in the first place?
3.) When conducting a pen/sec test what legal issues should be kept in
mind (e.g.. get out of jail free type of stuff).
5.) After a pen/sec test, if the client's network is cracked, can the
pen/sec company be held responsible?
6.) If the pen/sec company offers services such as actual securing of
systems, can they be held responsible if the systems they secured are
I'd appreciate as much feed back as possible. Once again I apologize if
this has already been discussed.
* Ben Lull
* ValleyLocal Internet, Inc.
* Systems Administrator
- [PEN-TEST] Legalities and Liabilities Ben Lull (Sep 12)