I have been engaging a client for two months now. They are a major electricity generation and distribution company.

For each project, I have got more than enough time to finish my SoapUI test cases so I am thinking to offer free security testings to my client.

But a second thought is telling me I should not be doing this as I could have charged them for doing it.

Should I add value to my engagement by doing free security testing?

  • 1
    Attempt to negotiate a fair price for security testing. If the client isn't willing to pay anything, then your "value added" is zero. – Joe Strazzere Mar 19 '17 at 19:17

Should I add value to my engagement by doing free security testing?

No, you should not and the reason is not about money.

  • Security testings need to always involve your clients' consents, which means before security testing is carried out, your clients need to be aware of it and explicitly give you a "green light"; this "green light" needs to be a tangible proof as well, e.g. a written consent.
  • The reason for this is: security testing is a very different animal comparing to other non-security testing. Security testing is treated very seriously as confidential information could be leaked, damaged or destroyed, critical processes could be paused or stopped, by executing a security test without informing your manager AND your client manager will be a very bad idea.

I have seen a real life example last year:

One contract tester did an unauthorized password attack on his client's database; his original intention might have been good but the result was his client's database automatically locked down, rendering it inaccessible. That company's business was dependent on accessing its database in real time. The whole business operation suddenly stopped for 2 hours for no apparent reasons. This was a very very bad.

Please do not execute any security tests without telling your manager AND your client's manager AND get your client's provable consent.

  • 1
    Your answer is implying quoting from OP, but those are your own words "I have seen a real life example last year." and the rest. Change formatting if your like it formatted differently. – Peter M. - stands for Monica Mar 20 '17 at 13:51
  • @PeterMasiar, ok, thanks for that. I will keep it in mind from now one – Yu Zhang Mar 20 '17 at 16:57
  • why would you execute said practices on a live/production database instance, no good can come of it. – symon Apr 5 '17 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.