Re: Evaluating pentesters

[Brent Huston <lbhlists () gmail com>]

Obtain and check references, do a Google search on the company name and the names of the principles. Check for real 
capabilities, research, contributions to the security community.

A little research will set apart the real security teams from the "scan and forget" vendors. It just takes a little 
time and energy. 15 mins per vendor and a browser will make it all make sense.


On Mar 9, 2010, at 12:55 AM, Jason Ross wrote:

> On Fri, Mar 5, 2010 at 7:01 PM, Tony Turner <tony_l_turner () yahoo com> wrote:
> > Is there some kind of "Who's Who" of penetration testing firms?
>
> In theory, there is; see http://securityscoreboard.com
>
> In practice, there's a lot of security companies listed on the site
> which have little information about them posted. That's largely
> due to the fact that the site is really just starting to gain momentum,
> but it still means that not a lot of data is available.
>
> Still, even without the full realisation of user scores and such, it's
> a helpful resource IMO. Specifically, it provides a very nice list
> of security companies broken down into specific categories.
>
> As folks start becoming aware of the site and using it, the rest
> will (hopefully) fall into place soon.
>
> --
> Jason
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
> and CEPT certs require a full practical examination in order to become certified. 
>
> http://www.iacertification.org
> ------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------