Re: Scanning through an IPS

[Matt - MRS Security <matt () mrssecurity com>]

Andre Gironda wrote:
> On Tue, Sep 23, 2008 at 11:28 AM, jond <x () jond com> wrote:
>   
> > I'm wondering what techniques everyone else uses when you know for a
> > fact you're scanning a client who has an Intrusion Prevention System.
> >     
>
> 1) Don't do pen-testing or vulnerability assessments like this.  See
> post/comments:
> http://securosis.com/2008/09/19/how-to-tell-if-your-pci-scanning-vendor-is-dangerous/
>
>
>   
Andre, What are your thoughts on the above? Your saying don't do it... 
But why?

Would it not be more cost effective for the merchant to have his full 
range tested? instead of maybe 2 ports? (SMTP/WWW)

Matt.





------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes in 
Securing Web Applications
Get 45 Min Video and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------