Question

A penetration tester completes an engagement and finds a serious flaw in a client's payment system. A colleague at another firm asks the tester to share details of the flaw over drinks so they can 'learn from it.' The client has not authorized any disclosure. Under the ISC2 Code of Ethics, what should the tester do?

Accepted Answer

Refuse to disclose the client's vulnerability, protecting the client's confidential information

Answer

Share the details, since discussing technical findings advances the profession

Answer

Share only a summary, since removing specifics makes disclosure acceptable

Answer

Post an anonymized description publicly so all defenders benefit