Re: Penetration Testing Scheduling

[Pete Herzog <lists () isecom org>]

Hi,

I just uploaded a little slide with graphic about test types from OSSTMM 3: 
http://www.isecom.org/Test_types.ISECOM.pdf

A thorough test is one where the auditor knows what is being tested and the 
target knows nothing of the test.  This allows the auditor to test the 
target as completely as possible including the reactions of the staff.  The 
worst kind of test is the kind where the auditor knows nothing about the 
target and the target is aware of the test because this will only test the 
skill of the auditor and the ability of the target to move itself out of 
"harm's way".

What kind of test depends on what it is used for. If it is for the client's 
education of applied protection then do it however they want it to be done 
while explaining to them the value of a thorough audit.  If it is for 3rd 
party certification then you are obligated to do the best and most thorough 
audit the 3rd party needs.  Ultimately, the client pays the bill and a good 
capitalist will do what fills the coffers. A good auditor however will do 
good audits.

-pete.


Yousif () Vapt-Sec com wrote:
> I appreciate everyones commentary on what I've questioned, but I don't think anyones providing a definite answer. If it's up the client, then that's done with, it's 
> clearly going to be what they want, not a problem. What if they don't take you up on that and you are the decision maker. I'm getting worthless comments from people telling me 
> that I should always have permission before security testing, but keep in mind that everyone knows that, commentary like that is just useless. Now, to focus on the question, let's say 
> both parties agree to fulfill the security testing, and the contracts have been signed, and the setup in general has been completed. To go on with your testing, do you let them know exactly 
> a date/time O R do you simply let them know it's a week from now.. I'm clarifying this because it seems like a lot of people are giving options, and that's always good to 
> have a choice, but I'm looking more for the "right" thing to do..
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------