Case Study - Ethical Penetration Testing - Coalfire vs. Iowa

Case Study: Ethical Penetration Testing: Coalfire vs. lowa

Instructions

Please read the following brief case involving pen testing and answer the following questions to test your own understanding of this technical and ethical subject.

Case Overview

Coalfire Systems Inc. provides compliance solutions, security and technology audits, among other things. Founded in 2011 and based in Colorado, it was the penetration testing, or pen test, services provided by Coalfire that placed the organization in a legal battle with the state of lowa.

In this, the first case of its type, two employees of Coalfire were arrested and charged with felony counts of third-degree burglary and possession of burglary tools after being found inside the Dallas County courthouse one early morning in September 2019. The charges were later reduced to misdemeanors. Engaged by the state to carry out pen tests on certain municipal buildings, in this case courthouses, Coalfire had successfully carried out similar tests on two different courthouses but this time things went badly wrong.

Upon trying to gain physical access to the Dallas County courthouse, the testers found a door to the building that had been left propped open.

Rather than simply entering the building, the testers closed the door and then attempted to break in. This action tripped the building's alarm and the local police were dispatched to the scene. At this point, the testing protocol would be to stop, wait for the police to arrive, explain the situation and present the documents supporting their authority for their actions. However, having opened the door, the testers entered the building to wait. Normally, once this had been completed, the incident would be over. But this time, the sheriff's deputies arrested the testers and took them to the local jail.

It is not uncommon that a pen test trips security alarms of one type or another, but being in possession of the right credentials (a letter of authority or contract) is usually where the matter ends.

Even though a contract existed between the state and Coalfire, Dallas County still pursued the case. All charges were eventually dropped against the testers in January 2020.