46 ms·

A common pentest isn't geared towards discovering architectural weaknesses like all Americans PII is one popped webserver away from disclosure. What's needed i

A common pentest isn't geared towards discovering architectural weaknesses like all Americans PII is one popped webserver away from disclosure. What's needed is an architectural security review, which is even rarer than people conducting an annual pentest.

tptacek 9y ago
What's your point? I'm saying, sitewide pentests almost always succeed.
- chris_wot 9y ago
  So they keep going till they fail?
  - tptacek 9y ago
    I don't understand your question. When I say a pentest succeeds, I mean that the testers succeeded in compromising their objective.
    - pas 9y ago
      Parent post is saying that that should constitute a failed audit. And it should be repeated as long as a 2 week effort by a pentesting team yields results.
    - chris_wot 9y ago
      So they plug the security holes, arrange a new pentest.
  - wglb 9y ago
    The target for most network pen tests is to obtain domain by noon of the first day. Generally, they keep going until they succeed and/or someone in the chain cries uncle.