A hospital, for instance, may not want us to come near its organ donor database. But Palmer and others also warn that if the limits are too restrictive, the testing's success can be compromised. We want to prove what a hacker can do to a web site and a system. While some small businesses don't have the resources to combat security threats, there are many small steps that can be taken to find out about fixes and solutions for security problems. One of the main sources of fixes for security problems are e-mail lists.
Many vendors have e-mail lists for their customers or post information on their web sites.
A good place to start is the SANS Network Security Digest from the SANS Institute. Standard configurations should be developed for all machines Stay on top of everything that could possibly go wrong. IBM recommends reading advisories for each vendor and for each application on your system. And be aware that each time you add interactivity between your company and your suppliers and customers, you may be opening a new penetration point. Any data input from a customer to your web site should be suspect.