4 ms·

Pentesters sometimes are leveraged as pawns in political games in organizations - seems similar with government. I think you are correct, the question is if th

by kerng 7y ago

Pentesters sometimes are leveraged as pawns in political games in organizations - seems similar with government. I think you are correct, the question is if the right stakeholders authorized this. You can't break into a 7/11 because some person working there authorized it. Authorization needs to be from all proper stakeholders.

alteria 7y ago
If this is true, is it Coalfire's fault for not verifying and are the two testers SOL with the burglary charge? Then is it also the fault of the two testers in this case that they too did not verify that all the correct stakeholders were brought in? It would suck to be in the position of the testers having little or no recourse.
- iforgotpassword 7y ago
  I'm very hesitant to blame the two individuals. While you should have basic understanding of the legal circumstances when working this job, you should be able to trust your higher ups that the paperwork is legit and thorough. A company the size of coalfire certainly has dedicated personnel just for dealing with that.
  - kerng 7y ago
    Agreed - very little blame goes to the pentesters, they didn't act with malicious intent as far as described. It's the higher ups on both sides that are accountable for the dilemma.
  - alteria 7y ago
    I am too, but was curious what degree of responsibility is expected of them by the law. i.e., is deferring to whatever sales/legal drafted enough of a defense, or something else. I work in professional services (although not pentesting), so I curious about what would happen to me if I was in a similar position.
- larssorenson 7y ago
  The previous discussion on HN highlighted Mens rea with regards to establishing intent, i.e. they didn't have criminal intent (they went in with the understanding that they had full rights and privileges to be there) and would probably (hopefully) be vindicated in a court of law. There is still a matter of CoalFire vs State / Local govt, where CoalFire might be liable for not confirming that they had the proper authorization to dispatch their testers (which is part of the state vs local issue that's ongoing). IANAL but I've been tracking this pretty closely since I'm also a pentester; everything seems to reasonably indicate that the two guys should be released, but someone else is likely ending up in a court over this.
0xDEFC0DE 7y ago
>Pentesters sometimes are leveraged as pawns in political games in organizations - seems similar with government. How?
- gotodengo 7y ago
  I've had clients tell me to hit certain known vulnerabilities specifically. I can see a situation where the decision to stay or swap off a system is being debated. If one party can send in testers and call out some vulns that might play to their hand.
  - tptacek 7y ago
    There's kind of a difference between clients and stakeholders gaming a pentest or spinning its results and pentesters not being authorized to test their targets. Even with basic web pentesting, rules of engagement particularly around which targets you're authorized to test is a big deal. This is a hell of a SNAFU.
    - gotodengo 7y ago
      Absolutely agreed. Especially since, in spite of my disagreement with the handling of things, the sheriff may have a point in the authorization angle. My initial comment pointed more generally to an example of politics within a company though.
      - tptacek 7y ago
        Like: a scenario that comes up all the time in ordinary web application testing: your authorized target interacts with a third-party API, for which you are not authorized to test. Pentesters generally get this right, because if you get it wrong, no matter what your client tells you, you're liable. (Indemnification may come into play here, but it won't matter criminally).
danShumway 7y ago
If the county is correct, the Information Security Officer for the Iowa state department payed someone to break into someone else's property. Why isn't there an arrest warrant out for them? If I payed someone to break into a 7/11, I strongly suspect I would get a visit from the police. Yes, the two employees could be liable for accepting a request from someone who obviously didn't have the authority to give it. But they wouldn't be the only people liable, and it seems silly to claim that they would be the first people liable. Why is it that the only two people arrested are those who had the least amount of responsibility and ability to check on the authority of the State department?
- dsfyu404ed 7y ago
  >Why is it that the only two people arrested are those who had the least amount of responsibility and ability to check on the authority of the State department? That outcome is why the word "pawn" is being thrown around.
- kerng 7y ago
  I tend to agree with your obervation.

by kerng 7y ago

alteria 7y ago

If this is true, is it Coalfire's fault for not verifying and are the two testers SOL with the burglary charge? Then is it also the fault of the two testers in this case that they too did not verify that all the correct stakeholders were brought in? It would suck to be in the position of the testers having little or no recourse.

iforgotpassword 7y ago
I'm very hesitant to blame the two individuals. While you should have basic understanding of the legal circumstances when working this job, you should be able to trust your higher ups that the paperwork is legit and thorough. A company the size of coalfire certainly has dedicated personnel just for dealing with that.
- kerng 7y ago
  Agreed - very little blame goes to the pentesters, they didn't act with malicious intent as far as described. It's the higher ups on both sides that are accountable for the dilemma.
- alteria 7y ago
  I am too, but was curious what degree of responsibility is expected of them by the law. i.e., is deferring to whatever sales/legal drafted enough of a defense, or something else. I work in professional services (although not pentesting), so I curious about what would happen to me if I was in a similar position.
larssorenson 7y ago
The previous discussion on HN highlighted Mens rea with regards to establishing intent, i.e. they didn't have criminal intent (they went in with the understanding that they had full rights and privileges to be there) and would probably (hopefully) be vindicated in a court of law. There is still a matter of CoalFire vs State / Local govt, where CoalFire might be liable for not confirming that they had the proper authorization to dispatch their testers (which is part of the state vs local issue that's ongoing). IANAL but I've been tracking this pretty closely since I'm also a pentester; everything seems to reasonably indicate that the two guys should be released, but someone else is likely ending up in a court over this.

0xDEFC0DE 7y ago

>Pentesters sometimes are leveraged as pawns in political games in organizations - seems similar with government. How?

gotodengo 7y ago
I've had clients tell me to hit certain known vulnerabilities specifically. I can see a situation where the decision to stay or swap off a system is being debated. If one party can send in testers and call out some vulns that might play to their hand.
- tptacek 7y ago
  There's kind of a difference between clients and stakeholders gaming a pentest or spinning its results and pentesters not being authorized to test their targets. Even with basic web pentesting, rules of engagement particularly around which targets you're authorized to test is a big deal. This is a hell of a SNAFU.
  - gotodengo 7y ago
    Absolutely agreed. Especially since, in spite of my disagreement with the handling of things, the sheriff may have a point in the authorization angle. My initial comment pointed more generally to an example of politics within a company though.
    - tptacek 7y ago
      Like: a scenario that comes up all the time in ordinary web application testing: your authorized target interacts with a third-party API, for which you are not authorized to test. Pentesters generally get this right, because if you get it wrong, no matter what your client tells you, you're liable. (Indemnification may come into play here, but it won't matter criminally).

danShumway 7y ago

If the county is correct, the Information Security Officer for the Iowa state department payed someone to break into someone else's property. Why isn't there an arrest warrant out for them? If I payed someone to break into a 7/11, I strongly suspect I would get a visit from the police. Yes, the two employees could be liable for accepting a request from someone who obviously didn't have the authority to give it. But they wouldn't be the only people liable, and it seems silly to claim that they would be the first people liable. Why is it that the only two people arrested are those who had the least amount of responsibility and ability to check on the authority of the State department?

dsfyu404ed 7y ago
>Why is it that the only two people arrested are those who had the least amount of responsibility and ability to check on the authority of the State department? That outcome is why the word "pawn" is being thrown around.
kerng 7y ago
I tend to agree with your obervation.