Penetration Testing mailing list archives
Re: Pen-testing - pricing model
From: Kish Pent <kish_pent () yahoo com>
Date: Sun, 17 Dec 2006 01:27:45 -0800 (PST)
Hey intel96, I know that many or most consulting firms give only a pen-test report [hard-copy, or password protected pdf file with "encrypted file container"] and a meeting where the testing team,manager, present their findings and the upper management discuss regarding the test. Now most times, people come up with "executive summary" and technical summary, and the HR asks you ... "okay, what about the "value"" of this pen-test ? What did we "gain" because of this "security-test" [as per their language]... Then we give the ROI analysis worked for their "infrastructure" [which includes security controls, network devices, and their boxes] This is done by us "for every pen-test" to keep the HR or the upper management satisfied about the "value" they get.[time-value tradeoff]. Regards PS: This post is a bit off-topic, so excuse me list ;) --- intel96 <intel96 () bellsouth net> wrote:
I have never seen a ROI analysis in a pentest report. How do you perform such an analysis?
Kishore Penetration Tester Smart Security 17/1,Upstairs,Sarojini St, T.Nagar , Chennai - 600 017 Phone: 91 98841 80767 __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Re: Pen-testing - pricing model, (continued)
- Re: Pen-testing - pricing model Davide Carnevali (Dec 16)
- Re: Pen-testing - pricing model Christine Kronberg (Dec 16)
- Re: Pen-testing - pricing model Davide Carnevali (Dec 16)
- LophtCrack and SAM Passwd William Woodhams (Dec 19)
- Re: LophtCrack and SAM Passwd Jerome Athias (Dec 20)
- Re: LophtCrack and SAM Passwd Justin Lintz (Dec 20)
- Re: LophtCrack and SAM Passwd killy (Dec 20)
- Re: LophtCrack and SAM Passwd Brendan Dolan-Gavitt (Dec 20)
- Re: LophtCrack and SAM Passwd jm (Dec 20)
- Re: Pen-testing - pricing model intel96 (Dec 16)
- Re: Pen-testing - pricing model Kish Pent (Dec 17)
- Re: Pen-testing - pricing model Sels, Roger (Dec 19)
- Re: Pen-testing - pricing model crazy frog crazy frog (Dec 03)
- Re: Pen-testing - pricing model intel96 (Dec 03)
- Re: Pen-testing - pricing model Stefano Zanero (Dec 03)
- Re: Pen-testing - pricing model Ozan Ozkara (Dec 03)
- Re: Pen-testing - pricing model intel96 (Dec 03)
- Re: Pen-testing - pricing model Lee Lawson (Dec 04)
- RE: Pen-testing - pricing model Erin Carroll (Dec 04)