Re: Evaluating pentesters

[Tracy Reed <treed () copilotco com>]

On Fri, Mar 05, 2010 at 07:01:33PM -0500, Tony Turner spake thusly:
> I've been burned in the past with some real bad ones..

Just out of curiosity, what makes for a bad pen-testing firm?

I'm going to be looking for one myself (PCI as well) and would like to
know what to avoid.

Although pen-testing is way-overrated IMHO. The attackers will have
far more time and be far more resourceful than your pen-testers will
ever be.

> Also not interested in paying good money for someone else to just do
> a Kismet/Gpsmap or Nessus scan for me and hand me the scan
> data. Useful tools of course, but I've met a few idiots who thought
> that was what penetration testing was. I am in the SE United States.

There seems to be a cottage industry of small shops praying on
merchants who don't really know what PCI is who will sell them a scan
and tell them they are good to go. It's happened here.

-- 
Tracy Reed
http://tracyreed.org

Attachment: _bin
Description: