Question for any Pen Testers out there

syklops

I'm putting together a proposal for a client and they have requested a Mea Culpa document. From what I have seen they have taken the EC Council's ECSA/LPT study guide and are treating it like the Pen Test bible as in this is how a pen test is done. I say this party because the only reference I can find to a mea culpa document in the context of a pen test is in the ECSA/LPT study guide. There is no other reference on the web.

I understand its something to do with delineation of liability. Have any pen testers out there used this document or could point me in the right direction?

The EC Council has come up in this forum before, and I think peoples opinion on them is pretty much the same. Their creation of the LPT, (Licensed Penetration Tester) is marketing genius. Its free money for them, to renew all you have to do is pay $250 a year once you have passed their exam. Unfortunately, this client thinks the EC COuncils methodology is the only one and I need to convince them otherwise. Do other pen testers see this as being the case also?

BaconZombie

Have a look at the PTES project, I'd say if it is not listed on there then it's some stupid propriety "test".

http://www.pentest-standard.org/index.php/Main_Page

syklops

BaconZombie wrote: »

Have a look at the PTES project, I'd say if it is not listed on there then it's some stupid propriety "test".

http://www.pentest-standard.org/index.php/Main_Page

Thanks for replying. Unfortunately I've already been to the PTES project, and I know one or two people involved in it and they've not heard of it either. I think you have summed it up accurately.

Capt'n Midnight

Don't tell me you are operating a computer without an ECDL :eek:

This lists 35 modules
http://www.eccouncil.org/Certification/exam-information/ecsa-exam-412-79

This is a 5 day course including certification - that's one hour per module
http://www.eccouncil.org/Certification/professional-series/ecsa-course-outline



http://www.eccouncil.org/Certification/lpt-faq

Why should I be licensed?

Penetration testers today have been certified by different agencies. But are they trusted? Do they follow a code of ethics? The answer is no.

So it's a rubber stamp that proves you've jumped through some hoops.

syklops

Capt'n Midnight wrote: »

Don't tell me you are operating a computer without an ECDL :eek:

This lists 35 modules
http://www.eccouncil.org/Certification/exam-information/ecsa-exam-412-79

This is a 5 day course including certification - that's one hour per module
http://www.eccouncil.org/Certification/professional-series/ecsa-course-outline



http://www.eccouncil.org/Certification/lpt-faqSo it's a rubber stamp that proves you've jumped through some hoops.


]

The somewhat ironic thing is I have jumped through the hoops and have the ECSA/LPT qualification. However, while the course makes reference to a Mea Culpa document, it never gave a sample of what one looks like. Do they even exist?