So, two penetration tests done for my client and this time around I've kept a 20 year security pen tester out of their domain after making changes based on the original recommendations and he can't do 95% of the things he was able to do before! At their DR site across the city where they have safeboot installed on all machines he couldn't do anything at all (not even get local admin passwords from the SAM) and wanted to go home at 3 in the afternoon
He tried a bit of social engineering on my clients site as well. He borrowed a British Telecom workmans jacket and went to downstairs reception asking for riser access in the basement to do work for the customer. The police were called after some checks were made about his identity. Classic!
The IT manager there thanked me for my work this year on getting the majority of the issues ironed out!
