Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 22 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Physical Securityarrow Physical pentesting - do pentesting companies shy from physical pentesting?
EH-Net
May 25, 2013, 05:09:57 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Physical pentesting - do pentesting companies shy from physical pentesting?  (Read 31365 times)
0 Members and 1 Guest are viewing this topic.
PenTestMag
Newbie
*
Offline Offline

Posts: 2


pentestmag.com


View Profile WWW
« on: June 20, 2011, 08:35:06 AM »

Pentesters - do pentesting companies shy from physical pentesting? How do you, pentesters, perceive this part of the job? Do you consider it the integral part of your profession, just like you do with vulnerability scanning and managment? Or is it just "something different"?
Logged
tturner
Sr. Member
****
Offline Offline

Posts: 432


View Profile WWW
« Reply #1 on: June 20, 2011, 10:20:33 AM »

If a security guard carries firearms or even a taser, I won't do physical pentesting. It's important, but I refuse to accept the risk.
Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog  @tonylturner http://bsidesorlando.org
millwalll
Guest
« Reply #2 on: June 21, 2011, 06:22:34 AM »

hmm I think is all depends on the scope of the work. Like anything with Pen testing if you don't have permission you just don't do it as it could get you into  trouble.

I personal think that all companies should take physical security and social engineer attack serious. I have read many books when all attacks on the network have failed however by walking in the company or ringing them 9 times out of 10 they have gained access this way.
Logged
tturner
Sr. Member
****
Offline Offline

Posts: 432


View Profile WWW
« Reply #3 on: June 21, 2011, 09:28:30 AM »

Definitely agree Jamie.R, I just don't want to be that guy. Let's say i have permission and a signed authorization from the CEO but an overzealous security guard decides he needs to take me down. He may not wait for me to fish a piece of paper out of my pocket. No thanks.
Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog  @tonylturner http://bsidesorlando.org
dalepearson
Sr. Member
****
Offline Offline

Posts: 357


View Profile WWW
« Reply #4 on: August 01, 2011, 03:49:58 PM »

There is risk involved of course.
However the realities are that not many companies are good at Physical Security.
If you have these concerns I would have some additional clauses in the engagement contract to cover the event of your own personal damage.

It doesnt stop it happening granted, but it gives you some insurance.
Logged

idr0p
Newbie
*
Offline Offline

Posts: 49


View Profile
« Reply #5 on: August 02, 2011, 01:52:30 AM »

Here are some physical Pen testers
http://laresconsulting.com/action.php
Logged

GCIA GCIH GPEN GWAPT
Up Next: CISA CISSP
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.064 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.