Penetration testing - service or commodity


We face this kind of issue everyday. There are two different approaches to web application penetration tests:

Penetration testing is all about assurance. In the first case the client will get some useful results, no doubt about it, but what level of assurance is it going to get? The report will cover the vulnerabilities discovered by XYZ software. Is that enough? I don’t think so, but that is for the client to decide. There is no question that the report will be incomplete and many issues will be missed.

In the second scenario the client can get the assurance that the results obtained were the work of a motivated attacker focused on the application security for X numbers of days. Is that enough? Again, it is up to the client to decide but in my opinion it gets so much closer to an acceptable assurance level.

It all depends on what do you want to be protected against. The decision in yours.

You may also be interested in...

Nov. 9, 2008

Penetration testing, antivirus, firewalls and false sense of security

False sense of security is an ongoing issue. Fueled by inaccurate marketing strategies promising the ultimate security product and convincing clients that their product will make your system immune to every single attack.

See more
Jan. 17, 2011

Metasploit and SQL injection

SECFORCE has released a set of scripts for enhancing Metasploit functionality exploiting SQL injection vulnerabilities

See more