From: Kevin Reiter (tux@penguinnetwerx.net)
Date: Fri Sep 02 2005 - 19:26:52 EDT
Craig Wright wrote:
> A pen test does not and by nature cover the requirements for SOX or any of the other areas.
>
> A Pen test can be used as a part of an audit but is not an audit. This is a common misconception, but it is definately wrong.
>
> I see this a lot (being a manager in a chartered firm). The audit requirements can not be satisfied by a pen test and any firm that believes this is deluding themself
>
> Craig
>
> -----Original Message-----
> From: Kevin Reiter [mailto:tux@penguinnetwerx.net]
> Sent: Wed 31/08/2005 3:18 PM
> To:
> Cc: sectraq@gmail.com; pen-test@securityfocus.com
> Subject: Re: Business justification for pentesting
>
>
> Don't forget about federal regulatory compliance issues, if your business
> falls under those categories (SOX, GLBA, etc.)
>
> Your company may even be *required* to have a third-party audit/test done
> periodically (i.e. once per year) in order to be "certified" to meet those
> federal requirements, as well as other items put in place (IDS,
> monitoring, etc.)
>
I wasn't meaning a pen test all by itself, which is why I mentioned
"audit" as well.
I also never said that a pen test would cover the requirements for any
certain area, but "could be a requirement" for one or more (meaning, in
addition to), as well as other items.
My apologies if my wording was wrong in the original post.
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:48 EDT