From: vince (vmarve@gmail.com)
Date: Mon Jun 13 2005 - 11:05:52 EDT
I do both. The company I work for will send out a VA team to identify
all possible vulnerabilities. The company then decides how much time
it will take to remedy all vulns. After that period a second team
will attempt a Pen Test.
The value added by the VA team is that of identifying everything. The
value of the Pen Test is to show impact and determine if the IT dept
did a good job applying fixes or if the weakness is in the IT dept
instead of the systems.
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:24 EDT