From: baumgartner@oneconsult.com
Date: Tue May 16 2006 - 12:41:45 EDT
I can only speak for (some) Swiss decision makers of local and world-wide operating companies/organisations. In the last two years, many clients evaluated and chose the OSSTMM to be their methodology to follow for security testing. These were and are the most important reasons for this decision:
1. The OSSTMM is the one and only (?) pen test methodology available that covers all steps from project planning, project organisation, and project and result documentation.
2. The OSSTMM is compliant with ISO/IEC 17799, ITIL, SOX, IT GSHB and many other standards and/or guidelines. Therefore, the OSSTMM complements these well-known standards. This point is of specific interest whenever the audience consists not only of technical folks.
3. Attached forms define the minimal requirements (=the filled in forms) of a OSSTMM compliant report. This implicitly warrants the quality of the testing work.
4. The OSSTMM is tool-independent. The 'Open Source' in the 'Open Source Security Testing Methodology Manual' means that everybody is free to use it without having to pay a license fee.
5. The OSSTMM counts on the merits of the testers, not on (company) brands.
6. The result is a value that can be compared easily instead of the typical 'good' or 'better' feelings in comparison to competitors or industrial sectors'.
By the way: a couple of non-Swiss security organisations use the OSSTMM as well.
Yours,
Christoph Baumgartner, OPST
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com for details.
------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:55:58 EDT