Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Security training of developers and company liability

from [Stephen de Vries] Network Security [Permanent Link]
Subject: Re: Security training of developers and company liability
Date: Thu, 8 Dec 2005 15:55:04 +0700

I used to be a trainer on the ISS Ethical Hacking course in the UK and it was standard practice to have the delegates sign a waiver that they would only use their new powers in defense of the empire.

Not sure whether this was strictly necessary in the UK, it could have been a knee jerk reaction from the US legal department.
It rarely hurts to play it safe.

cheers,
Stephen

On 7 Dec 2005, at 23:51, James Strassburg wrote:

I am currently training all of my organization's software developers on
web application security. I'm using WebScarab and WebGoat as my primary
teaching tools as I feel that seeing how the problems are exploited is
much more effective than trying to cover every type of coding mistake
that can lead to the problems. My question is about company liability.
What if one of the developers used the information learned to attack
another site? Is my company liable for their actions as we taught them
how to do it? Should I have our legal department create a disclaimer or
waiver for them to sign?

I will be asking the same questions directly to our legal department but
thought a discussion here could provide some more insight and be
valuable for others. thanks.


James A. Strassburg Jr.     
Software Security Architect     
Direct Supply, Inc.


[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  RE: Security training of developers and company liability, Griffiths, Ian
Next by Date:  RE: Security training of developers and company liability, Lyal Collins
Previous by Thread:  Security training of developers and company liability, James Strassburg
Next by Thread:  RE: Security training of developers and company liability, Clement Dupuis
Indexes:  [Date] [Thread] [Top] [All Lists]