As Yu Zhang has said NEVER perform security tests without consent. There are no exceptions to this rule.
You need to make it clear to the team member that senior management would be justified in firing him for his reckless actions. For that matter, your customer could choose to take legal action against him including criminal charges.
That said, there are clearly training issues if one of your team members thought it appropriate to run a security test against a customer's live data.
Some things I'd consider in addition to Yu Zhang's excellent points:
- Wherever possible, potentially destructive security tests should be run in an isolated non-production environment. That includes separate servers.
- If a separate environment is not available, potentially destructive or disruptive security tests must be run off-hours when there are few or no customers using the application. In this case extreme care must be taken to ensure no real data is harmed.
- Always have a prior agreement with rules of engagement and stick to it. This must be in the form of a written contract. Emphasize that any security testing without a prior agreement is illegal hacking.
- Don't be afraid to use this incident to remind your team members of potential consequences. Security is important, but one of the reasons all reputable security testing organizations work with detailed contracts and rules of engagement is that security testing in progress is indistinguishable from hacking attempts. I can't stress that enough. To a customer or system admin who has not been notified of security testing, there is no difference between a hacking attempt and a security test in progress.
I was recently involved with penetration testing for one of the applications I test. The penetration testing firm made these arrangements:
- We provided a sandboxed environment that was isolated from and a mirror of our production environment.
- The security testers notified us each day before beginning testing.
- At the end of each testing session, the security testers sent us a brief summary of their findings.
- Every critical vulnerability they found was reported to us immediately
- Rules of engagement included that if they gained direct access to either the servers or the database it was "game over" and they ceased testing and notified us of what they had done and how to fix the problem (this didn't happen, but it was worth having that limitation in place).
It's worth making a list of terms like these for your team members to memorize as standard practice for working with customers.