28 Sep 09 Security Consultant – Scope of work

As a Security Consultant, I’ve always had a difficult time with the scope of work and just how much detail to go into during the test. What to pen test is more often than not strictly defined, however what detail to go in to, is often not. In some cases the time constraints dictate the detail of the penetration test itself, however often with pen testing, more time is allowed than is necessary.

I have a specific example in mind, whereby I identified a possible DoS (Denial of Service) attack against a service running on a particular vendor’s hardware. The attack was only vaguely theoretically possible, however given the spare time, I did spend a number of hours writing an actual implementation of the Denial of Service attack, and then demonstrating proof of it’s functionality. At that point, the Client changed various configuration options which prevented this DoS, whilst technically mildly limiting functionality.

Should I not have gone to the time of actually writing this particular DoS attack, chances are that this configuration change would not have taken place and a flaw would have been left unchecked. After consulting with a few other pen testers, they all confirmed that they would not have gone in to anywhere near as much detail, and most likely just pointed out a potential for the denial of service on the final report. Personally, given the same opportunity again, I would certainly go into the same level of detail.

On a slightly related note, most pen testers make a point of keeping busy with the tests themselves rather than engaging in discussions with the Client. I can see the advantage of this, as you are technically being engaged as a penetration tester, and not as an IT/Network Consultant or Web/PHP Developer. I however, am usually happy to discuss the processes and progress of the test with the Client during the testing. In one case, flaws identified were resolved and re-tested whilst the engagement was in progress, which I personally found to be a very enjoyable and productive way of working together.

Tags: consultant, denial of service, dos, pen test, penetration test, PHP Developer, Security Consultant, web developer

Leave a Comment

You must be logged in to post a comment.