There should be a provision in every Managed Service Providers contract with their clients to perform an authorized scan and probe of their client’s networks at least once a quarter. Granted, as a highly professional and efficient MSP, there should never be any holes to exploit, but it is always nice to show your client the results of the same tools that the script kiddies use.

Since day one, we have always run a Nessusne scan on our potential clients (with authorization of course) and quarterly with our regular clients as well. Recently I’ve begun upgrading our scans with some basic light pen-testing of some major sticking points. Now that I’ve started adding some of these basic pen-tests, the responses from potential clients has improved dramatically. It’s always one thing to explain to them why they need strong passwords, but when you can hack their RDP session in a matter of hours, it really gets them to understand why they need a good password.

It is a good way to impress upon your clients the need for security, and also helps to keep your staff and contractors on their toes if they know you run real penetration tests against your client’s networks. The driving force for making sure I run these basic tests were due to a recent meeting with a client who insisted that they leave their Domain Administrator password as a simple 6 character password that was quite easily guessed. In order to impress upon them the importance of having a good password policy, I got them to agree to let us hack their network. Starting from scratch, I was able to download the appropriate script kiddie tools, run my cracks and gain full Administrator access to the sole domain controller on the network.

As much fun as it was, I really learned that this was a useful tool, and something I should be doing for all my clients. So now, all our clients are going to be receiving an additional page with their quarterly scans that details the penetration testing of their network. My question to you is; “What do you do to make sure that your clients are actually secure”?