Reply to post: Even then

From pen-test to penitentiary: Infosec duo cuffed after physically breaking into courthouse during IT security assessment

Anonymous Coward
Anonymous Coward

Even then

Performing an actual break in as part of a test seems incredibly risky, what if in the dark one of the cops sent to the scene thinks they see a gun and kills one of the "pen testers"? This is the US, after all. I can't imagine any tester willingly participating in this, or any governmental body agreeing to it.

I also can't believe that any sort of accreditation would REQUIRE an attempted ACTUAL break in completely unsupervised. If a walk thru to look for weak points like unlocked windows or easy to pick locks on unalarmed back doors in dim lighting isn't good enough, then you'd have guys trying to perform a break in under the watchful eye (and protection!) of guards/police. I doubt any legit company EVER tries an actual break in where a real police response thinking it is an actual crime in progress may result. Only a moron would agree to that, on either the side of the company, the government, or the company employee.

Something is fishy here, I wonder if the people who were caught were acting outside their authority and figured with the knowledge they had from their pen testing they could break in and commit an actual crime, but have plausible deniability. "Someone else exploited the weaknesses we had identified and were in the process of documenting in our report". If part of what they'd identified so far was "password to county bank account containing millions of dollars is on a sticky note" then getting inside would be all that would be required for them to easily steal money...if those damn cops hadn't shown up!

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon