Free first conversation
What needs doing, and who would authorise it.
London · Information technology services since 2017
Same tools.
Same tools.
Differentpaperwork.
The technique that tests a system and the technique that attacks one are identical. Under the Computer Misuse Act, authorisation is the only thing separating a service from an offence. So it gets written down and signed before anything is touched.
- 2017since
- 1990the Act
- Writtenor nothing
- Scopeis the limit
What we do
Four services, one precondition
Nothing is accessed, scanned or tested without written authorisation from someone entitled to give it.
Authorisation first
Written authorisation, from someone with the authority to give it.
See the programScope as a boundary
Systems, addresses, accounts and time windows defined before work begins.
See the programThird-party systems
Hosted and cloud infrastructure, where the client is not the one who can authorise.
See the programIT services
Support, infrastructure and technology work alongside the assessment side.
See the program
How it works
How we work
Get authorisation in writing from a person entitled to give it, define the scope as a boundary rather than a suggestion, obtain the consent of whoever owns third-party infrastructure, and report rather than pursue anything discovered outside the agreed list.
Authorisation in writing
Signed by someone with the authority.
Scope defined exactly
Systems, accounts and time windows.
Work, then report
Findings to you, access closed afterwards.
Working together
What it costs
Quoted per engagement in pounds sterling after a first conversation. Nothing begins before authorisation is signed.
An assessment
Scoped, authorised and reported.
- Written authorisation first
- Scope defined in advance
- Third-party consent checked
- Findings reported to you only
- Nothing described as secure
Ongoing IT services
Support and technology work, month to month.
- Access defined and authorised
- Processor agreement in place
- Credentials handled properly
- Access closed at the end
- One point of contact
What we will not do
Said up front, because the line is criminal rather than contractual.
- No access without written authority
- No testing beyond scope
- No third-party systems without consent
- No tooling for unauthorised use
- No publishing your findings
Every engagement is quoted after a free consultation. No subscription.
How we work
Authorisation is the whole difference
TERRACE FELLOWS LTD was incorporated in England and Wales on 10 October 2017 under company number 11005804, with its registered office at 75 Clarence Road in London, and has had the same director throughout. Its registered activity is other information technology service activities.
In this field the method used to find out whether a system is secure and the method used to break into one are the same method. There is no technical feature distinguishing them, which means the distinction has to come from somewhere else, and under the Computer Misuse Act it comes from authorisation. Access to a program or data without authorisation, where the person knows it is unauthorised, is a criminal offence, and that remains true whatever the motive and however valuable the findings. Two consequences shape how any careful practice works. First, authorisation must come from somebody with the authority to give it, and a willing contact inside an organisation is not automatically able to authorise testing of that organisation's infrastructure; establishing who can is part of the job rather than an administrative delay. Second, the agreed scope is the limit of the authorisation, so testing beyond it is unauthorised activity even within an otherwise authorised engagement. That makes scope creep a different category of problem from the contractual one people assume. Where systems sit on a third party's infrastructure, the client frequently cannot authorise testing of it at all, and the owner's consent is required. All of which is why nothing here starts before a signature.
Frequently asked
The questions we get most
Why do you need authorisation in writing before anything?
Because under the Computer Misuse Act, access to a system or to data without authorisation is a criminal offence, and the techniques used in a security assessment are indistinguishable from the techniques used in an attack. Authorisation is the only thing separating the two. A verbal go-ahead, an existing support contract or someone handing over credentials are not substitutes for it, and relying on any of them would put both sides in a bad position.
Can my IT manager authorise a test?
Possibly, and it depends on their actual authority rather than their enthusiasm. A request from an individual inside an organisation does not by itself establish that the individual can permit testing of that organisation's infrastructure. Satisfying ourselves on that point is part of our job, not yours, and it occasionally delays a start by a day. That is a considerably better outcome than the alternative.
What happens if you find something outside the agreed scope?
We report it and we stop. The agreed scope is the limit of the authorisation, so activity outside it is unauthorised even where the engagement itself is properly authorised. An interesting asset discovered mid-engagement is reported rather than explored, and testing extends to it only after a written extension agreed in advance. Scope creep here is not a billing conversation, it is a legal boundary.
Our systems are hosted elsewhere. Does that change anything?
Yes, and it is the thing most often missed in good faith. Where infrastructure is operated by a third party, you may not be in a position to authorise testing of it, because it is not yours to authorise. We need the consent of the party entitled to give it and we comply with whatever testing policy they impose. Otherwise an otherwise careful engagement ends up partly unauthorised.
Can you confirm our systems are secure afterwards?
No, and nobody honest will. An assessment describes what was found within the stated scope, by the stated methods, during the stated period. The absence of a finding is not evidence of the absence of a vulnerability, it is evidence that the methods used within that scope and that window did not surface one. Anybody issuing a certificate of security is selling a feeling rather than a finding.
What happens to what you find?
It goes to you and nowhere else. Findings are not published, not passed to third parties and not retained beyond the agreed period. Credentials and data encountered during an engagement are handled only as the engagement requires, and access is closed at the end rather than left in place because it might be convenient later. We also do not supply tooling to anyone for use against systems they are not authorised to access.
Got something that needs looking at properly?
A free first conversation, with no obligation.