3 ms·
The market is not nearly saturated with firms capable of delivering security assessments (penetration tests + source code reviews) with high technical proficien
by dsacco 9y ago
The market is not nearly saturated with firms capable of delivering security assessments (penetration tests + source code reviews) with high technical proficiency. I started a consultancy several years ago which has done very well among smaller tech companies, and I know of at least two new consulting practices started this year by ex-NCC folks.
There are many, many firms that bill for web scanning and static analysis. Their business model boils down to, buy a bunch of tools for <$10,000, resell their usage on engagements for >$5,000 per week. They leave a trail of horror stories in their wake eventually. Starting a consulting shop is a great opportunity if you have the requisite skill/experience, and can differentiate yourself from the snake oil salesmen of the industry and the monolithic firms everyone knows.
The industry for internal security engineers as well as outside security consultants is growing at a healthy pace. In my circles, people usually need to widely advertise a position to get it filled by someone qualified. In one case, a friend of mine at a tech company informed me that he had only one candidate pass the phone screen in three months despite posting the position here on HN, on /r/netsec, etc.
Consulting firms are a different sort of beast because they are usually always hiring. Every security consultant added to a growing firm directly increases the total amount of potential revenue, and most successful firms have to start turning away work at a certain point (for example, I no longer take on work for network security because I find it unenjoyable, I would much rather work on reverse engineering and application security engagements).
Everything I've said is US-centric, but hopefully it's reasonably helpful and relevant to you in the UK. I know a few bug bounty-turned-security-consultant people in the UK and they seem to be reasonably well off, but they could be outliers (in fact they are, skill-wise).
- srednalfden 9y agoCan you mention who the UK testers are? I'm curious.
- dsacco 9y agoI'm sorry, I would rather not say specifically who without their permission :) If you really want to know, you can generally find them by browsing the list of top security researchers for large bug bounty programs. That should give you a start.
- PerfectElement 9y agoAs a small company with limited budget who is looking to have its application tested, how can we differentiate between good firms and firms that will just run a scanner and charge you $5000? Also, is it a good idea to hire a freelancer to pen-test your application?
- dsacco 9y ago> As a small company with limited budget who is looking to have its application tested, how can we differentiate between good firms and firms that will just run a scanner and charge you $5000? Reputation, mostly. It's easier for the large firms that everyone is familiar with. For smaller firms, you probably want to get a strong referral from someone who has been through this before. Also, ask the consultant(s) performing the assessment what they'll be doing in some technical depth to see how familiar they are with a penetration test/source code review outside of running Acunetix or Burp Suite Scanner. They shouldn't shy away from talking about what specific technical vulnerabilities they feel they're likely to find when you describe your app and its stack off the top of their heads. > Also, is it a good idea to hire a freelancer to pen-test your application? Theoretically, this is a good cost savings versus a firm. But in practice, it's hard to do correctly because you really need to be sure that the person knows what they're doing. If you want to hire a freelancer, I would suggest looking for very well-known/successful bug bounty participants and security researchers who opened their own solo shops. Also, shameless plug: if you're looking for a security assessment I'm happy to help you (and if I can't directly, I am nearly positive I can refer you to very competent smaller firms for your budget). Feel free to get in touch.