Temperini/Macedo/Caire/Borghello: "Panel Debate: Actividades de Seguridad"

### Overview In this panel session from Ekoparty (ECHO 2020), cybersecurity practitioners and legal professionals Marcelo Temperini, Cristian Borghello (referred to as Cristian), Ramiro Caire (introduced in the talk as Mina Caire / Ramiro), and Maximiliano Mazzeo discuss the legal, contractual, and operational challenges of offering offensive security and IT security consulting services. Addressing the high degree of informality in penetration testing and security audits, the panel analyzes the preliminary findings of an anonymous community survey and proposes community-driven solutions, including a legal hackathon to draft a standard contract template and develop an automated contract generation application.

### Key Topics - **Industry Informality and Legal Risks**: Security activities such as penetration testing, ethical hacking, and social engineering frequently touch sensitive legal boundaries. Operating without explicit authorization or written agreements exposes security professionals to allegations of unauthorized access or breach of regulations (such as Central Bank requirements). - **Survey Findings on Professional Practices**: Based on 97 survey responses, the panel shared key statistics: - Most respondents had over 10 years of security experience, while about 20% were early-career professionals (1–2 years). - 78% were clear about who contracted them, but 16% worked through third-party outsourcing where they had no direct contact with the end client, creating authorization blind spots. - Only 33% reported always working with signed contracts, while 23% never signed a contract, and roughly 70% lacked formal contractual coverage most of the time. - 60% always read and negotiated terms they disagreed with when presented with a contract, while others often felt intimidated by extensive legal documents. - **Operational Pitfalls & Client Relationships**: - **Scope Creep**: 60% cited scope creep as their primary problem, where clients expand testing boundaries beyond initial agreements. - **Payment Terms**: 44% reported payment delays or issues, emphasizing the need to explicitly define milestone terms (e.g., 50% upfront, remaining upon final report delivery). - **Reporting Disconnects**: Approximately 30% struggled with final reports, stemming from misaligned expectations, balancing technical detail against executive clarity, and client resistance to disclosing vulnerabilities internally.

### Technical Details - **Third-Party Authorization & Surprise Audits**: Penetration testing targets owned or hosted by third parties require clear contractual verification. The panel advised that client contracts should explicitly mandate 15-to-30-day advance notice for audits involving third-party infrastructure to avoid unlawful unauthorized access. - **Evidence Integrity and Objectivity**: Security reports must remain self-contained, objective, and backed by verifiable technical evidence. Subjective commentary or political opinions can alienate clients or invite accusations of fabricated findings (e.g., modifying screenshots in Paint). - **Documenting Out-of-Scope and Defensive Controls**: Clearly recording systems where attacks failed or where defensive mitigations succeeded demonstrates thoroughness, acknowledges client security measures, and prevents unmanaged liability.

### Takeaways - Formalizing engagements with a clear, written, digitally or electronically signed legal contract protects both ethical hackers and clients regarding scope, deadlines, and liability. - Practitioners should clearly establish delivery timelines contingent upon mutual client cooperation, noting that client delays in providing information directly extend the schedule. - To combat industry informality, the panel launched an open hackathon initiative to collaboratively produce an open-source, customizable service contract template and build an automated web/software tool that generates these legal agreements step-by-step without collecting personal data.