3 ms·
There are thousands of firms who will happily run a vuln scan or webapp crawler and send you a crappy canned report. There are less who can really perform a com
by spydum 9y ago
There are thousands of firms who will happily run a vuln scan or webapp crawler and send you a crappy canned report.
There are less who can really perform a comprehensive test and document the hell out of it.
I personally think pen testing is not very useful, except as a 3rd party check to tell you if you've done a reasonable job at protecting your software (and if you get a bad tester, you literally won't know!). We need more people in InfoSec who can explain how to build defensible software - finding holes is the easy part.
- philjr 9y agoThese things are not really mutually exclusive. Defense in depth. Getting more information on building defensible software does not preclude the need to have someone knowledgeable try to rip it apart afterwards.
- spydum 9y agoI don't disagree on this, but the mentality of pentesting (as I have seen it conducted) is wrong. Typically a firm wants to find a way in, and snatch the Crown Jewels. Once they achieve that, the level of effort goes way down, and they often leave a lot of surface area unchecked. Or maybe more succinctly: they are incentivized to find SOMETHING quickly, rather than EVERYTHING. I think it can help if the testers are internal and not quite under the same time pressure / engagement limits though.