From: tarunthenut@gmail.com
Date: Mon Jun 13 2005 - 07:25:24 EDT
i asked this question cause i failed to understand why certain clients are bent on penetration testing cause the results totally depend on the skill set of the person/company performing the penetration testing.
I am of the opine that the companyx should get a two vulnerability assessments (not penetration testing) done.
Scan 1: With its preventive and reactive controls switched off (IPS/IDS/HIPS etc). Results ranked not on technical ranking (most tools/VA companies tabulate on tech rankings) but on business impact ranking.
Scan 2: with the preventive and detective controls switched on (IPS/IDS/HIPS etc). Again results ranked on business impact rankings.
The second result with test the effectiveness of security controls in place. Based on the two scans, the companyx should go about plugging those vulnerabilities in phased manner:
Phase I: Plug those which could be "identified" (not necessarily exploited) inspite of security controls switched on and have high business impact.
Phase II: Plug those which could be "identified" (not necessarily exploited) inspite of security controls switched on and have medium or low business impact.
Phase III: Plug those which could be "identified" (not necessarily exploited) when security controls were switched off and have high business impact.
(To ensure "safety" even when any preventive or detective control fails)
Phase IV: Plug those which could be "identified" (not necessarily exploited) when security controls were switched off and have medium or low business impact. (To ensure "safety" even when any preventive or detective control fails)
What say ppl. Does this approach make any sense into the chaos?
Regards
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:24 EDT