Microsoft® Windows® 2000 Security Handbook

External Consultants

There are a few items to consider when looking for an outside consultant:

• First, make certain that you are working with a reputable firm. Ask for references and follow up on them. Make certain that they have done good work for other companies first. You certainly do not want to be the training grounds for an inexperienced penetration tester.

• Limit the scope and timeframe of the test to ensure that they are achieving results. Limit the scope to all attacks that do not interrupt service directly or indirectly (no denial-of-service attacks). Make certain you have a contact at the firm whom you can reach at any hour of the day because security firms might not test on an 8-to-5 schedule, and in case an attack does bring down a ...