RE: bank audit pen test

You do this with the usual CYA.  You develop an agreement and have your
customer sign it.  You should have policies in place to support a data
classification scheme, and procedures in place to deal with the resultant
information.  You would have to restrict who will get access to these
results, outline how you will store or dispose of them, state that your
company will take no action on the resultant information, and try to get
indemnification of liability.  Insurance and legal counsel never hurts
either.

Mark

-----Original Message-----
From: Keenen Milner [mailto:kmilner@ghcllc.com]
Sent: Saturday, October 29, 2005 12:03 PM
To: Coreappsecurity Mailing List; security-management@securityfocus.com
Subject: bank audit pen test


I have a different twist on the bank audit question.

If as part of the audit, you perform a pen test and the bank gets hack
the day after you deliver your results, can you be sued? I know anyone
can sue anyone for anything but how can you realistically reduce the
chance you get sued.

Best Regards, 
Keenen 
____________________________________________________ 
Keenen Milner 
Lead Partner - Computer Forensics and Technology Consulting
GHC Information Systems, LLC
Grobstein Horwath and Company, LLP
15233 Ventura Boulevard, 9th Floor
Sherman Oaks, California 91403
(818) 325-8466 - voice 
(818) 325-8566 - fax 
____________________________________________________

<<attachment: winmail.dat>>