The two men arrested for breaking into an Iowa courthouse are listed in a contract between their contractor and Iowa's Judicial Branch as 'penetration testers.'

Malicious cyber criminals use all techniques at their disposal—fair or foul—to access valuable data from private and public organizations. Global cybersecurity firms (such as Coalfire) involved in technical testing are professionally contracted to simulate real-world attacks using the same techniques any attacker may use to test the company’s defenses so that they can remedy their vulnerabilities before a real-world attack occurs.

Recently, two penetration testers employed by Coalfire were arrested in the Dallas County Courthouse during a security testing exercise to help the Iowa Judicial Branch ensure the court’s highly sensitive data was secured against attack. Coalfire was working to provide quality client service and a stronger security posture.  Coalfire and State Court Administration believed they were in agreement regarding the physical security assessments for the locations included in the scope of work.  Yet, recent events have shown that Coalfire and State Court Administration had different interpretations of the scope of the agreement.  Together, Coalfire and State Court Administration continue to navigate through this process. To that end, the Iowa Judicial Branch and Coalfire will each be conducting independent reviews and releasing the contractual documents executed between both parties.

State Court Administration has worked with Coalfire in the past to conduct security testing of its data and welcomed the opportunity to work with them again. Both organizations value the importance of protecting the safety and security of employees as well as the integrity of data.

State Court Administration apologizes to the sheriffs and boards of supervisors of Dallas County and Polk County for the confusion and impact these incidents have caused. 

Links below are to the contract documents with allowable redactions

Requirements and Assumptions

Service Order—Redacted

Rules of Engagement—Redacted

Social Engineering Authorization—Redacted

Master Agreement—Redacted

Two men arrested for breaking into the Dallas County Courthouse on Wednesday told law enforcement that the state judicial branch had sent them.

Iowa court officials authorized "various means" to check county court's security.

For under $100, compact hardware can turn a shipped package into a Trojan horse for attacks.

Brian B. King // This is a companion post to BBKing’s “Hack for Show, Report for Dough” report, given at BSides Cleveland in June 2019. The fun part of pentesting is the hacking. But the part that makes it a viable career is the reporting. You can develop the most amazing exploit for the most surprising […]

A social media post from one of a company's interns was all this people hacker needed to enter a secure area with a counterfeit employee badge. Learn tips for welcoming new employees securely.

Explains what Jek's "got domain" probably means: successfully (faux)-authenticated into one of the target's Windows domains, possibly enabling migration to other machines or even pwning the domain controller.

The Penetration Testers Framework (PTF) is a way for modular support for up-to-date tools. - GitHub - trustedsec/ptf: The Penetration Testers Framework (PTF) is a way for modular support for up-to-...

Exercises.

The Setup

Configuration files for the SOF-ELK VM, used in SANS FOR572 - sof-elk/VM_README.md at main · philhagen/sof-elk

The Principles based on the organization Keeping Private and Confidential information gained in your professional Work.

An online platform for learning and teaching cyber security, all through your browser.

Snap Labs helps cybersecurity teams instantly spin up hyper-realistic, cloud-based cyber labs that save time and resources.

PentesterLab: Learn web hacking the right way

PentesterLab: Learn web hacking the right way

Welcome to hacking-lab.com