Re: Is Pentesting Goal Oriented, or Coverage Oriented?

[Chris Griffin <chris () logossecurity com>]

I agree that finding one point in and stopping is an incomplete test.

If you follow a mature methodology such as the OSSTMM, you will find
that the goal is to completely cover within your scope of the test.

We KNOW there are ways in, the point is to show them as many as possible,
show them the controls that should be in place and also to make sure they
respond, ie know you got in via some sort of alarm control.

IMHO it's time to move past auditing for the sake of complying with
having an audit done
and to audit/test to find your weak points. I have seen far to many
companies only testing,
AND limiting their own scope for a better score, just because its mandated.

Chris


On Fri, Oct 2, 2009 at 9:02 PM, Daniel Miessler
<daniel () danielmiessler com> wrote:
> Greetings List,
>
> I'm having a discussion with Johannes Ullrich via the SANS Application
> Security Streetfighter Blog on whether penetration testing is goal or
> coverage oriented.
>
> Johannes's position is that a pentest that attains a goal, e.g. root access
> or a database dump, and then stops is an incomplete and poor pentest. He
> believes a good pentester should continue finding as many vulnerabilities as
> he can.
>
> I hold the opposite view, which is that a penetration test is, by
> definition, focused on achieving a specific goal, and that if the aim of
> testing is to find as many vulnerabilities as possible the type of test
> you're performing is a vulnerability assessment.
>
> Here are the original arguments:
>
> Johannes:
> http://blogs.sans.org/appsecstreetfighter/2009/09/30/pentesting-do-you-need-coverage/
> Me:
> http://blogs.sans.org/appsecstreetfighter/2009/10/03/response-pentesting-coverage/
> My Original:
> http://danielmiessler.com/blog/infosec-vulnerability-assessment-vs-penetration-test
>
> I'm curious as to what the list thinks of the two perspectives.
>
> --
> Daniel R. Miessler
> W: http://danielmiessler.com
> E: daniel () danielmiessler com
> P: 0x4048712D
>
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually
> do a proper penetration test. IACRB CPT and CEPT certs require a full
> practical examination in order to become certified.
> http://www.iacertification.org
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------