Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 79 guests and 1 member online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Physical Securityarrow Physical pentesting - do pentesting companies shy from physical pentesting?
EH-Net
May 26, 2012, 06:37:30 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Physical pentesting - do pentesting companies shy from physical pentesting?  (Read 19371 times)
0 Members and 2 Guests are viewing this topic.
PenTestMag
Newbie
*
Offline Offline

Posts: 2


pentestmag.com


View Profile WWW
« on: June 20, 2011, 08:35:06 AM »

Pentesters - do pentesting companies shy from physical pentesting? How do you, pentesters, perceive this part of the job? Do you consider it the integral part of your profession, just like you do with vulnerability scanning and managment? Or is it just "something different"?
Logged
tturner
Sr. Member
****
Offline Offline

Posts: 329


View Profile WWW
« Reply #1 on: June 20, 2011, 10:20:33 AM »

If a security guard carries firearms or even a taser, I won't do physical pentesting. It's important, but I refuse to accept the risk.
Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GSEC, OPSE, CSWAE, VCP

Next 6 months: GCIH, CSTP, STI MSISE
Jamie.R
Hero Member
*****
Offline Offline

Posts: 626



View Profile WWW
« Reply #2 on: June 21, 2011, 06:22:34 AM »

hmm I think is all depends on the scope of the work. Like anything with Pen testing if you don't have permission you just don't do it as it could get you into  trouble.

I personal think that all companies should take physical security and social engineer attack serious. I have read many books when all attacks on the network have failed however by walking in the company or ringing them 9 times out of 10 they have gained access this way.
Logged

OSWP | eCPPT | HackingDojo Nidan
www.jamierougive.co.uk
tturner
Sr. Member
****
Offline Offline

Posts: 329


View Profile WWW
« Reply #3 on: June 21, 2011, 09:28:30 AM »

Definitely agree Jamie.R, I just don't want to be that guy. Let's say i have permission and a signed authorization from the CEO but an overzealous security guard decides he needs to take me down. He may not wait for me to fish a piece of paper out of my pocket. No thanks.
Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GSEC, OPSE, CSWAE, VCP

Next 6 months: GCIH, CSTP, STI MSISE
dalepearson
Sr. Member
****
Offline Offline

Posts: 356


View Profile WWW
« Reply #4 on: August 01, 2011, 03:49:58 PM »

There is risk involved of course.
However the realities are that not many companies are good at Physical Security.
If you have these concerns I would have some additional clauses in the engagement contract to cover the event of your own personal damage.

It doesnt stop it happening granted, but it gives you some insurance.
Logged

idr0p
Newbie
*
Offline Offline

Posts: 49


View Profile
« Reply #5 on: August 02, 2011, 01:52:30 AM »

Here are some physical Pen testers
http://laresconsulting.com/action.php
Logged

GCIA GCIH GPEN GWAPT
Up Next: CISA CISSP
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.201 seconds with 21 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.