Slashdot Mirror
Penetration Testing TV Series Coming
ChazeFroy writes "CourtTV (TruTV) has a new series starting Dec. 25 at 11 pm called 'Tiger Team.' It follows a group of elite penetration testers hired to test organizations' security using social engineering, wired/wireless penetration testing, and physically defeating security mechanisms (lock picking, dumpster diving, going through air vents/windows). They do all of this while avoiding the organizations' various security defenses as well as law enforcement. The stars of the show also did a radio spot this morning in Denver." Wonder how they socially engineer away the presence of a camera team in the air vents.
No, I'd like to see "I'm A CEO - Get Me Out Of Here".
Steve Ballmer, a stack of chairs, and Larry Page. Oh, and a couple of bottles of tequila. And handguns.
Darl McBride, twelve inches of hosepipe and a bottle of fireants - lube will be optional.
Who else wants to see Mark Burnett or Jon de Mol pick this up and run with it?
Isn't it illegal to knowingly call the cops with a false report? I realize that the specific IT person or security guard won't be in on the joke, but whoever sets up the "penetration test" knowingly is setting up an employee to call in a false report. This means the corporation as an entity is calling in a false report.
Actually, a TV team might even help. Make it big, even show off that "you're coming on TV" and you'll see people cooperate with anything, because hey, they're getting screen time! Start interviewing them, they'll be nervous and distracted, you could even steal their computer underneath their hands without them noticing it because hey, they're on TV!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The one pen-test group I consulted for long ago had a very serious procedure in place to verify and document everything before starting the job. This was just electronic/internet/social penetration, no testing of physical security. Much of what they did was related to legal (through the courts) attacks, they would mostly have meetings with the in-house council or retained law firms to ensure they were ready to respond to lawsuits, indictments, and media accusations. The electronic pen-test was a sideline to verify legal compliance where personal and financial data was stored or processed.
Before they would do any kind of network scanning, database testing, or even attach one of their laptops to the network, they would require a face-to-face meeting with the entire board of directors and senior management. The meetings would be video taped and documented, and all sides would sign the agreement stating the entire scope of the work, and work wouldn't start until after the video tapes and legal documents were safely stored off-site and reviewed. They required the head of legal council to affirm on video and in a signed document that the company was aware of the testing to be done, and held the pen-test firm free of any liability (I don't remember the exact British legal term they used).
It was good they got this level of protection for us, I've heard many stories from ex-pen testers about being hired by the supposed head of IT, only to discover the CTO was unaware of the agreement. Even having a signed document from someone in the company isn't good enough in the short term if the company turns around and bites you. One friend was driven out of business by court costs despite a signed document, his company just didn't perform due-diligence on the authority of the IT director. Another friend was blamed for hacking and destroying the main database, before they had even arrived on site to plug into the network. While they were still in the IT directors office looking for a working network jack, the DBA accused them of hacking and destroying the main data base. They didn't get paid for that job, they just walked away when the IT director didn't side with them.
I don't do security pen-testing any more, most companies who hire pen-testers do so in place of either writing a policy, or implementing it. They want pen-testers to break things so they can get more budget, and that's it. Even asking up front for the basics like a list of equipment or range of IP addresses shows most companies don't know their own inventory. Pen-testers then become scapegoats, often with associated criminal complaints.
The video clip commercial looks downright scary. This show has the potential to turn public opinion into laws preventing any kind of security consulting, whether it's something simple like a paper audit of a security policy or a complex review of network configuration. You just know this show is edited for maximum Rambo/DieHard/IndianaJones effect because preparation and meetings are boring.
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
BANK EMPLOYEE: (typing on a check) So, people hire you to break into their places... to see if you can break into their places?
BISHOP: It's a living.
BANK EMPLOYEE: (looks at check, hands it to BISHOP with sympathetic expression) Not a very good one.