Re: pricing model for Pen-test

[<dave () immunitysec com>]

In-Reply-To: <20031112204753.26518.qmail () sf-www3-symnsj securityfocus com>



Any pricing based on a per-IP is bogus anyways. The client knows you are doing a time-based estimate. Just say "6 Class 
C assessment for 2 weeks is 10K" the same as a "1 Class C assessment for 2 weeks" . As long as you define the scope to 
basically be a nessus scan plus any extra time that you have goes into "verification" you have all the wiggle room you 
need. And pricing based on a time estimate is more honest, in my opinion, than tried to develop some complex price 
scaling algorithm based on scope. Your SOW should have the time limit explicitly in it. 

IMO,
Dave Aitel
Immunity, Inc.

> From: <a55mnky () yahoo com>
> To: pen-test () securityfocus com
> Subject: pricing model for Pen-test
>
>
>
> We are responding to an RFP with very little detail - client has 6 class C networks.  We have been given no 
> information on how many hosts are live on each and/or how many services are offered on any hosts.  Any suggestions on 
> how to price the engagement - certainly there is a significant difference in effort between one web server per subnet 
> and 100+ hosts with multiple services on each.
>
> Thnaks in advance.
>
> a55mnky
>
> ---------------------------------------------------------------------------
> Network with over 10,000 of the brightest minds in information security
> at the largest, most highly-anticipated industry event of the year.
> Don't miss RSA Conference 2004! Choose from over 200 class sessions and
> see demos from more than 250 industry vendors. If your job touches
> security, you need to be here. Learn more or register at
> http://www.securityfocus.com/sponsor/RSA_pen-test_031023
> and use priority code SF4.
> ----------------------------------------------------------------------------

---------------------------------------------------------------------------
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_pen-test_031023
and use priority code SF4.
----------------------------------------------------------------------------