full-disclosure - sample of what's required to be written in a security related contract

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: ravyn at omega2.com (ravyn)
Subject: sample of what's required to be written in a
 security related contract

On Tue, 3 Feb 2004, just for know how wrote:

>   my fellow colegue from the commercial dpt. asked what guarantees could
>   i offer and if i had a sample contract for such services. Now my fellow
>   posters, i ask for thy help. Could anyone help me with such a contract
>   ? Basicly any IIS-like paper will do. A sample contract for this type
>   of services. Kthx. [...]

guarantees?  i don't think you want to even touch that one.  you can
guarantee that you'll set up the machine, that it'll boot, and that it'll
route packets from one network to another, but if you or anyone in your
marketing department is considering the idea of any sort of security
guarantees (i.e., this machine will never get rooted, your files will
never be compromised, or we guarantee at most one break-in per year) then
i think you're opening yourself up to some serious liability.

--ravyn