4 ms·

Please share more information on the "whys".

by goshx 8y ago

tastroder 8y ago
One why would be, as long as you don't have a clause permitting this in your contract with the SaaS provider (which "ordinary" people as in this context usually don't have) it would be considered an offense in most countries. If you're a company and the SaaS provider is of similar or small scale you might be able to work with them if you have special security concerns that exceed their regular customer base. You could maybe even get them to hire a consultancy to check or recheck their services but in no case would you ever just go out and do that of your own volition. Independent of that, even in a personal context, people use SaaS providers because they trust their ability to do a certain job better and/or cheaper than you could do yourself. That usually includes the factor of securing their data, if only because it's in their best interest not to have PR disasters and lose customers.
PeterisP 8y ago
In general, obtaining access to your account at some service providers requires you to defraud, social engineer or hack that service. To be able to do that legally, you need permission from the service provider, permission of the owner of the account isn't sufficient. So any company claiming to provide such service is either not doing so legally or (more likely) limiting their activities to various passive approaches and not attempting to actually pentest/social engineer access to your accounts in ways like an actual attacker would; so they're implying that they provide a better, more serious service than they actually do.
johnnycab 8y ago
You either need prior approval or follow certain rules to conduct any pen-testing, red-team exercises etc. on most cloud platforms, largely to prevent happy-go-lucky/break-things-fast types from installing Kali on a whim and running a riot. https://aws.amazon.com/security/penetration-testing/ https://aws.amazon.com/security/penetration-testing/ https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement https://www.microsoft.com/en-us/msrc/pentest-rules-of-engage...

Please share more information on the "whys".

by goshx 8y ago

Please share more information on the "whys".

One why would be, as long as you don't have a clause permitting this in your contract with the SaaS provider (which "ordinary" people as in this context usually don't have) it would be considered an offense in most countries. If you're a company and the SaaS provider is of similar or small scale you might be able to work with them if you have special security concerns that exceed their regular customer base. You could maybe even get them to hire a consultancy to check or recheck their services but in no case would you ever just go out and do that of your own volition. Independent of that, even in a personal context, people use SaaS providers because they trust their ability to do a certain job better and/or cheaper than you could do yourself. That usually includes the factor of securing their data, if only because it's in their best interest not to have PR disasters and lose customers.

PeterisP 8y ago

In general, obtaining access to your account at some service providers requires you to defraud, social engineer or hack that service. To be able to do that legally, you need permission from the service provider, permission of the owner of the account isn't sufficient. So any company claiming to provide such service is either not doing so legally or (more likely) limiting their activities to various passive approaches and not attempting to actually pentest/social engineer access to your accounts in ways like an actual attacker would; so they're implying that they provide a better, more serious service than they actually do.

johnnycab 8y ago

You either need prior approval or follow certain rules to conduct any pen-testing, red-team exercises etc. on most cloud platforms, largely to prevent happy-go-lucky/break-things-fast types from installing Kali on a whim and running a riot. https://aws.amazon.com/security/penetration-testing/ https://aws.amazon.com/security/penetration-testing/ https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement https://www.microsoft.com/en-us/msrc/pentest-rules-of-engage...