Re: bank audit pen test

That is a question for your legal department. As with many liability 
cases, if you can show that you took adequate steps (or at least didn't 
drag your feet) to address your recently discovered vulnerabilities, you 
might be able to avoid/reduce legal action and financial damages. 
Typically, a successful lawsuit would require proving negligence on your 
part.

However, if the hack resulted in disclosure of customer information in 
violation of California's SB 1386 privacy law, it might be a completely 
different situation. Again, you should ask your lawyers about this rather 
than the opinions of this group.

- Rich

 



"Keenen Milner" <kmilner@ghcllc.com> 
10/29/2005 12:03 PM

To
"Coreappsecurity Mailing List" <CoreAppSecurity@bankinfosecurity.com>, 
<security-management@securityfocus.com>
cc

Subject
bank audit pen test






I have a different twist on the bank audit question.

If as part of the audit, you perform a pen test and the bank gets hack
the day after you deliver your results, can you be sued? I know anyone
can sue anyone for anything but how can you realistically reduce the
chance you get sued.

Best Regards, 
Keenen 
____________________________________________________ 
Keenen Milner 
Lead Partner - Computer Forensics and Technology Consulting
GHC Information Systems, LLC
Grobstein Horwath and Company, LLP
15233 Ventura Boulevard, 9th Floor
Sherman Oaks, California 91403
(818) 325-8466 - voice 
(818) 325-8566 - fax 
____________________________________________________