How to Avoid Going to a Federal Prison for Penetration Testing

There's only one difference between hacking and penetration testing: PERMISSION.

BEFORE CONDUCTING A PENETRATION TEST :

• GET A WRITTEN AGREEMENT BETWEEN YOU AND THE ORGANIZATION

• AGREE UPON AN EXACT TIME AND DATE

• NOTIFY ALL AFFECTED PERSONNEL

• WHO DO I CONTACT FOR MATTERS OF URGENCY?

​

AFTER CONDUCTING A PENETRATION TEST :

• CREATE A WRITTEN REPORT OF FINDINGS

• SECURELY SEND THE REPORT TO SENIOR MANAGEMENT