Penetration testing - service or commodity

imagensecforcepost.png

We face this kind of issue everyday. There are two different approaches to web application penetration tests:

Penetration testing is all about assurance. In the first case the client will get some useful results, no doubt about it, but what level of assurance is it going to get? The report will cover the vulnerabilities discovered by XYZ software. Is that enough? I don’t think so, but that is for the client to decide. There is no question that the report will be incomplete and many issues will be missed.

In the second scenario the client can get the assurance that the results obtained were the work of a motivated attacker focused on the application security for X numbers of days. Is that enough? Again, it is up to the client to decide but in my opinion it gets so much closer to an acceptable assurance level.

It all depends on what do you want to be protected against. The decision in yours.

You may also be interested in...

imagensecforcepost.png
April 6, 2017

Firewall against firewall – bypassing an IPS

In this post we are going to explain how we used "iptables" to bypass an Intrusion Prevention System during a recent penetration test.

See more
imagensecforcepost.png
Oct. 11, 2012

SECFORCE achieves ISO27001:2005

SECFORCE has been accredited to ISO27001:2005 by the British Assessment Bureau.

See more