Re: Security Grade

[Francois Larouche <francois.larouche-ml () sqlpowerinjector com>]

Hi Eddie,

usually I try to be out of all kind of philosophical and subjective 
threads but here I had to say something. At least bring a different view 
of this topic.

The way you rate the real threat can lead the management to think that 
the problem is not that grave, especially with only 3 levels of 
security. I'm concerned about the fact that "Yellow" grade will leave 
the executive management with the impression that: "ok, Yellow is not 
too bad at least it's not Red..."

And from there not unblocking sufficient budget and efforts or have a 
false sense of security.

The reason why I'm concerned about is that both your criteria are really 
a high threat to the company in my opinion.

_Gain administrative control of the target_:

That one speaks for itself... It's common knowledge that if I own a 
machine on your system I "generally" own your network. After that it's 
just a matter of effort and time. How bad could that be? I leave it to 
your imagination. So from there you can get Number 2.

_Retrieve proprietary or confidential information_:

Well that I guess depends on how critical is the data. But as far as I'm 
concerned should be treated accordingly. However, I believe that if I 
can get all the credit card info from all the customers it's pretty 
critical to my eyes... Or get all the salary of the employees in the 
company to name a few examples.

I believe that yes executive management wants concise and no technical 
issues but they are not pure idiot and can understand the difference 
between having the customer's credit card information stolen with only 
having the pictures of their employees accessed.

Like I said at the beginning it's rather a subjective topic and they are 
many good ways to grade the threats of a pen testing. The only criteria 
is that all the actors in the process understand the true threat(s) 
behind to act accordingly. And if you Eddie had no problem to pass the 
message to them then in the absolute your system was good for your 
company but I still think it's a dangerous way to do things in general.

My two cents

Francois

> I used to use a three results (Red, Yellow, Green) system based on two criteria:
>
> First:  Did I gain administrative control of target system(s).
> Second: Did I retrieve proprietary or confidential information.
>
>  If I was unable to achieve either objective, the client received a
> "green" rating.
> If I was able to achieve only one objective, the client received a
> "yellow" rating.
> If I was able to achieve both objectives, the client received a "red" rating.
>
> It sounds very simplistic, but using that system made the results
> immediately clear to executive management (who really didn't care
> about the technical issues.)  It also makes it very simple to create
> graphs comparing other clients by industry, size, budget, etc.  Again,
> this gives the executive summary clarity and impact.
>
> Thanks,
> Eddie
>
> On Dec 6, 2007 5:17 AM, 11ack3r <11ack3r () gmail com> wrote:
>   
> > Hi,
> >
> > Is there a security criteria or matrix against which we could grade
> > customer's pen test results? Like assigning them grade between A to E
> > or 1 to 10.
> >
> > *.*
> >
> >
> >
> >     
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
> ------------------------------------------------------------------------
>
>
>   


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------