3 ms·
I think the arguments against penetration testing are interesting. As a software test engineer, we do external audits like this, but I wonder: Documented or "
by r0s 11y ago
I think the arguments against penetration testing are interesting.
As a software test engineer, we do external audits like this, but I wonder: Documented or "known" vulnerabilities are not worth testing until there are systems in place that expect to cover them.
It seems that all vulnerabilities that are not intentionally addressed should be considered dangerous. If they are penetration tested but vulnerability is unknown, the best you could hope for is "Not vulnerable for unknown reasons" which is just as bad as vulnerable in my perspective.
With some admitted trepidation, I assert that all software should be tested this way, with expected behavior being a primary dependency.
Edit: hiring outside penetration testers is still totally valid and desirable, since development and testing are two totally different domains. I'm only pondering methodology.
- kenbaylor 11y agoI believe a LOT of security testing will evolve to QA and software testing. There a LOT of issues will be found. Instead on micro-focuses (in the past), the CD approach can test the whole system, which is a huge leap forward. Pen-tests should be good reality checks to ensure the system is working, and that it is sufficient to withstand current attacks. Sometimes companies are very smug and need the reality check. Boards are starting to request them to ensure the confidence is warranted. I've also seen pen tests used as a tool to GET funding. Fail one big time due to known vulnerabilities just to show how messed up things really are...then get a budget to fix them.
- r0s 11y agoThe smugness thing really hits home. Sometimes clueless, overconfident or downright negligent people are so embedded in a culture that an outside expert opinion is exactly what's needed. Thanks for the reply.