.

My first offical pentest - Writing contract

<<

pwned

Newbie
Newbie

Posts: 3

Joined: Tue Feb 15, 2011 1:29 pm

Post Tue Mar 08, 2011 12:39 pm

My first offical pentest - Writing contract

I'm about to do my first offical pentest in 2 days and is working on a contract that gives me permissions to do the test and so on.

But since I havn't worked by contract before I would like a nudge in the right direction when it comes to the contracting-part.

Bottomline on the test:
A company that offers hosting and webdesign is in the need of a pentest on their webplatform which include sites designed and coded by them that is hosted on their server.

So basically I will do a "full" pentest, excluding password-attacks and DoS-attacks.

The only thing I get down in the contract so far is:
- The company permits me, under a period of time, conduct the pentest.
- All information and results are confidential.
- As a result of the test, a presentation with the admin which include fixes.
- The test will be conducted within the companies network.

I know that I'm missing ALOT but I would really need someone to nudge me in the right direction.
<<

hell_razor

User avatar

Jr. Member
Jr. Member

Posts: 90

Joined: Wed Jul 14, 2010 10:44 am

Post Tue Mar 08, 2011 1:08 pm

Re: My first offical pentest - Writing contract

You should probably try to include an indemnity clause for any downtime, damage to their systems, etc., as part of the permission section.  They may decline it (all contracts are negotiable and should be treated by both parties as such), but try.
A+, Network+, Server+, CISSP, GSEC, GCIH, GPEN, GCIA, GISP, GCFW
<<

Xen

User avatar

Sr. Member
Sr. Member

Posts: 386

Joined: Tue Feb 03, 2009 3:59 am

Post Tue Mar 08, 2011 11:25 pm

Re: My first offical pentest - Writing contract

<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Fri Mar 11, 2011 8:03 pm

Re: My first offical pentest - Writing contract

I'd be terrified to do a pen test with a contract I wrote. I hope this went / is going well for you. You should seriously have a lawyer who is familiar with these types of services write the contracts for you. Have you purchased insurance?
The day you stop learning is the day you start becoming obsolete.

Return to Career Central

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software