Re: OSSTMM how good is it?

[baumgartner () oneconsult com]

Hi,

I can only speak for (some) Swiss decision makers of local and world-wide operating companies/organisations. In the 
last two years, many clients evaluated and chose the OSSTMM to be their methodology to follow for security testing. 
These were and are the most important reasons for this decision:

1. The OSSTMM is the one and only (?) pen test methodology available that covers all steps from project planning, 
project organisation, and project and result documentation.

2. The OSSTMM is compliant with ISO/IEC 17799, ITIL, SOX, IT GSHB and many other standards and/or guidelines. 
Therefore, the OSSTMM complements these well-known standards. This point is of specific interest whenever the audience 
consists not only of technical folks.

3. Attached forms define the minimal requirements (=the filled in forms) of a OSSTMM compliant report. This implicitly 
warrants the quality of the testing work.

4. The OSSTMM is tool-independent. The 'Open Source' in the 'Open Source Security Testing Methodology Manual' means 
that everybody is free to use it without having to pay a license fee.

5. The OSSTMM counts on the merits of the testers, not on (company) brands.

6. The result is a value that can be compared easily instead of the typical 'good' or 'better' feelings in comparison 
to competitors or industrial sectors'.

By the way: a couple of non-Swiss security organisations use the OSSTMM as well.

Yours,

Christoph Baumgartner, OPST

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to rise, 
you need to proactively protect your applications from hackers. Cenzic has the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------