So umm... Best Way to Start Your Own Security Consulting/ Penetration Testing Company

Hi guys, so I was browsing around, as I tend to do and the Start Your Own Security Company thread caught my eye. This topic intrests me greatly because I too would someday like to start a small security company. Unfortunatly, NOBODY answered the OPs question in the 4 pages that was the thread before it killed itself. You would think the title had been "Do you think I'm 1337 enough to start a security company?" or something.

Well maybe none of you have any experience in that area(which would be ironic), but if any of you do I would really like to hear some advice or experiences. Successes and failures such as what works, what doesnt... I think this topic is would be a great contribution to the AO community.

SOOOOOOOO... have any of you started your own security company? What scale did you initially start at and what were some of the hurdles in getting up and running. How do you find clients and what measures do you take to protect yourself from liability? What range of services do you offer?

Good luck on this topic, as you read what happened to my thread. I was just looking for the same advice as you.

Quote:

---

have any of you started your own security company?

---

Certainly not! because failure is a virtual certainty.

1. You need to have been in the business for a long time.
2. You need to have been a senior consultant in a major consultancy for at least 5 years.
3. You need to be prominent in the industry through seminars, publications and the like.
4. You need a number of similar standing individuals on your team.

Unfortunately ones ability to do the job is relatively unimportant compared to the reputation of the people who get hired. You see a lot of these exercises are CYA (cover your a$$) rather than a true security job. The customer doesn't really care about security, they are just looking for a feel good factor.

Back in the day, it was an old saying that "nobody ever got fired for buying IBM".....................well, the same kind of thing goes for security consultants these days. Sure you might be able to do as good a job, and a hell of a lot cheaper, but trust me when I say that no corporate EVP is going to put his neck on the line, for the sake of saving a few thousand bucks.

It is pretty much the same with external auditors. Small companies deal with small companies and the big boys go to the likes of PriceWaterhouseCoopers.

I believe the advice was given....

Know your stuff

Get lots of experience

Keep your certs up to date

Be a good sales person

have the resources to to the job

Get incorporated.....so if the lawsuits fly..you are not personally liable

be REALLY good at what you do

All outlined in the original post......

:rolleyes:

MLF

I concur with everyone else. Even highly regarded information security experts don't usually start companies on their own. Take Ed Skoudis for example, he is a highly regarded information security professional, author of a few books, and wrote and teaches for SANS. He confounded a company with a few other information security professionals. So I highly doubt you will have much success on your own.


I have had a great deal of laughs about the other thread as I can remember the first time a client handed me a "security audit" completed by a so called security consultant. The so called consultant ran a Nessus scan and then managed to press the print button. He didn't even bother to bind it or anything, just a loose stack of pages presented to the client. If this entertainment keeps up than I am canceling cable.

Until you have worked for a company exclusively conducting security audits under the watchful eye of another professional for at least 3 years, then I wouldn't dream of it.

Hmmmm, I am afraid that this is the problem:

Quote:

---

So umm... Best Way to Start Your Own Security Consulting/ Penetration Testing Company

---

That is a very specialist and restricted service that would require you competing with a relatively small number of established organisations, much larger than yourself.

A much more feasible approach to starting your own business is to go one level further down and look at the day to day activities of smaller businesses.

This requires understanding business processes and procedures as Morgana~ has suggested.

Other areas such as network design, database design, separation of business functions, data security, disaster recovery and business continuity , authorised usage policies, data protection and so on.

All these areas have security implications but they also have business implications and are far more likely to be understood by the managers/owners of small businesses.

When it comes to financial systems, for example, there is no need for internet connectivity at all. It should be a self contained network and penetration testing should be irrelevant. What matters more is authority levels and checks and balances.

I don't know what things are like in other countries, but over here at least 95% of small business fraud is either the good old fashioned confidence trick, or it is internal (that is most of it). This is a problem that the owners are aware of and will gladly pay for consultancy for.

Sure, the law says that they have to have external auditors to examine their statutory accounts but the smaller companies cannot afford full time internal auditors or security specialists in their IT function.

It is far cheaper for them to hire a local consultancy firm for 12 weeks and then for a two week review every year than to employ a permanent member of staff who would probably get bored to tears and leave fairly quickly.

A contractor would be an alternative, but they come and go and disappear off the face of the earth. A permanently established local consultancy is the ideal solution.

It is also ideal for someone getting started in their own business as the big boys cannot compete (too many overheads) and are not interested in the smaller jobs.

Over time you might be able to concentrate more and more on security, but to begin with it would be prudent to offer a broader range of services and extend your earnings base.

In the UK you often have to be CLAS or CHECK certified (in addition to CISSP) before you'd get looked at by a large company or public sector. These are government sponsored and you can't buy your way into them (alledgedly).

You could still work for smaller companies who can't (or won't) pay for CHECK teams. Get work and build your reputation that way. Most security companies offer other services such as ISO certifications, forensics etc.

CLAS - http://www.cesg.gov.uk/site/clas/index.cfm
CHECK - http://www.cesg.gov.uk/site/check/index.cfm

Some companies we have used

http://www.dns.co.uk/
http://www.sapphire.net/
http://www.mwrinfosecurity.com/

I've found that the best way to go about starting your own business is to first work in the field for another larger company.

1.) Study, test, repeat -- Get some Alphabet soup for the back of your name
2.) Work in industry in excess of 10 years
2 alt) Go to school with a Co-Operative education program ;) RIT places students with PenTesting companies for 3 month periods up to 6 months at a time...
3.) Get hired by a larger firm and gain experience there
4.) THEN think about splitting off and forming your own.

Applications many people use for PenTesting are VERY expensive Think CORE or Immunity's CANVAS although you can pen-test using the standard hacker fare, you should use a multitude of tools and I reccomend you use atleast one of the biggies. I know for sure I'd rather be buying a new Jeep than a seat for a pen-testing program.

But hey, what do I know? I run a computer business building custom computers to a small customer base. It's more a hobby business anyway...

This is some good advice, this is all I was asking the other day.

NetSecExpert

I think it was spelled out in the other thread.......E X P E R I E N C E

and by the way...whining doesnt become you

MLF

It's been all said, but I will sum up.

To start your own InfoSec Consultancy, you need, first and formost, the ability to successfully startup ANY COMPANY...it doesn't have to be an IT Security company...if you can't start your own pizza delivery company, you won't be able to start a consulting firm. Add to that the skills, reputation, and capability to be an trusted security consultant (either by having the skills yourself, or hiring the right people with said skills and reputation) and then, maybe...MAYBE, you can make a go of it.

LLC's and startups are like @ssh0les...nearly EVERYONE has one. I know I did. Didn't do me for jack or schitt.

Not trying to dissuade you, but I doubt most of the people on this forum who I respect and look to as my equals or betters... they probably wouldn't be any more successful than I, if we went off and tried to do this ourselves. It's not NEARLY so easy or cool as it sounds.

Thanks for all the replies, particulary nihil has been very helpfull. So a start up company that is strictly a security consulting group would have a hard time competing with the few large firms that dominate the field, yet as a small company with smaller goals in mind you would have trouble finding enough clients to keep the business afloat long term without some serious ability to sell yourself. That's kind of what I figured.

Now breaking into the market as a tech group covering a wide range of services such as network design, computer repair and troubleshooting, along with more small business oriented solutions could be the gateway towards making a name, building relationships and creating a foundation to introduce higher end services to people who already trust you. This makes sense from a business standpoint.

I'm curious as to what sort of schools or programs offer placement with existing companies. Xenolithic mentioned Co-Operative education programs and RIT and these sound interesting. Could you give me more information or point me in the right direction for finding out about what these programs are and the benifits?

Aspman linked me to pages describing the CHECK and CLAS certs, which I havent heard of before. Are these limited to the UK and its government or is it a worldclass credential? Either way that sounds like it's far from my grasp but interesting to know about.

So the idea that having a big name being more important that actual skill is a very candid peek into the security field. That's just a trait of big business I suppose. Now how about the credibilty of certifications over schooling? Or that of technical training vs. a full blown degree?

Quote:

---

Originally posted here by Liquid_Darkness
I'm curious as to what sort of schools or programs offer placement with existing companies. Xenolithic mentioned Co-Operative education programs and RIT and these sound interesting. Could you give me more information or point me in the right direction for finding out about what these programs are and the benifits?

---

I'm in the Applied Networking and Systems Administration program at RIT and what we do is extend the standard 4 year college degree program into a 5 year program with 3 semesters/quarters/whatever dedicated to field work. The placement is entirely up to the student as to where they want to go, and if the school doesn't bring in the recruiters then you can seek employment yourself and then apply for co-op credit.

SPARSA Alums have gone on to work for Security Managment Partners (SMP), Crowe, and CounterPane, we currently have a friend who's at Mitnick LLC ;)

Anyway, the program is built into the standard education that one can get from RIT. I'm not sure as to how many schools offer such a program mainly because I'm a student/staffer at the Institution with SPARSA and the ANSA program.

You can find out more @
RIT Office of CoOp and Careers

If you're interested, I can put you in contact with one of our SPARSA Alums who are now in the field.

DeVry Institute always has commercials on TV for "guarunteed job placement services to all graduates". I know Colorado Technical University (not just in Colorado...a few other states are covered, too) has a similar program.

I know that, with the right polish and experience, a proper candidate can get on with Big Security Firms (TM) WITHOUT education or certification...if they can prove their worth. Firms like, oh, I dunno...ISS, Symantec, VeriSign, etc.