Re: Is Pentesting Goal Oriented, or Coverage Oriented?

[Zack Payton <zpayton () gmail com>]

Code complete, exploitation far and wide encourages fixes in many  
departments .  Just as their defense are multilayered, so should be  
your attack. Card exposure on any assessment is a critical finding.

Sent from my iV

On Oct 2, 2009, at 9:02 PM, Daniel Miessler  
<daniel () danielmiessler com> wrote:

> Greetings List,
>
> I'm having a discussion with Johannes Ullrich via the SANS  
> Application Security Streetfighter Blog on whether penetration  
> testing is goal or coverage oriented.
>
> Johannes's position is that a pentest that attains a goal, e.g. root  
> access or a database dump, and then stops is an incomplete and poor  
> pentest. He believes a good pentester should continue finding as  
> many vulnerabilities as he can.
>
> I hold the opposite view, which is that a penetration test is, by  
> definition, focused on achieving a specific goal, and that if the  
> aim of testing is to find as many vulnerabilities as possible the  
> type of test you're performing is a vulnerability assessment.
>
> Here are the original arguments:
>
> Johannes: http://blogs.sans.org/appsecstreetfighter/2009/09/30/pentesting-do-you-need-coverage/
> Me: http://blogs.sans.org/appsecstreetfighter/2009/10/03/response-pentesting-coverage/
> My Original: http://danielmiessler.com/blog/infosec-vulnerability-assessment-vs-penetration-test
>
> I'm curious as to what the list thinks of the two perspectives.
>
> --
> Daniel R. Miessler
> W: http://danielmiessler.com
> E: daniel () danielmiessler com
> P: 0x4048712D
>
>
> --- 
> ---------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification  
> Review Board
>
> Prove to peers and potential employers without a doubt that you can  
> actually do a proper penetration test. IACRB CPT and CEPT certs  
> require a full practical examination in order to become certified.
> http://www.iacertification.org
> --- 
> ---------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------