4 ms·

Pentesting can be about highlighting poor budgets and security practices - I’ve had clients basically hand me findings because they just want a report that says

Pentesting can be about highlighting poor budgets and security practices - I’ve had clients basically hand me findings because they just want a report that says how crap they are. I’m not a huge fan of physical breaches purely because they’re not a realistic threat model - maybe in the case of larger court houses that house evidence in cases where people might have the resources to do such a breach, but in most situations no decent attacker would risk their face on camera when malware.docx.exe would suffice

Spooky23 7y ago
If what you describe had been done, this wouldn’t be news. If I were the CIO or CISO of the state court, I would want to audit a few courts, and work with them to test those controls. That’s where you work with the county to test their controls - just like your scenario. Then the test is a tool that can be used to get funds from the state, county and federal government to fix the problems.
- chris_wot 7y ago
  Well, I have to say the restricted parameters they gave them weren’t worth a damn.
  - Bnshsysjab 7y ago
    Fwiw real breaches don’t care about parameters. I know the law doesn’t see it that way, and the pentesters probably should have cared a bit more but most contracts I see basically caveats reports to say ‘and any related systems’ which gives something that will cover basically anything that would be considered ‘reasonable’ in the court of law. The purpose isn’t to be an asshole, it’s to actually raise issues when you’re otherwise limited by sleazy performance-paid project managers trying to limit your scope to basically nothing.
rhinoceraptor 7y ago
It seems like physical pentesting is more about putting on a show. If you can break into the network remotely, most people have a hard time understanding the technical details. But if you can break into a courthouse undetected, now you have something everyone understands.

Spooky23 7y ago

If what you describe had been done, this wouldn’t be news. If I were the CIO or CISO of the state court, I would want to audit a few courts, and work with them to test those controls. That’s where you work with the county to test their controls - just like your scenario. Then the test is a tool that can be used to get funds from the state, county and federal government to fix the problems.

chris_wot 7y ago
Well, I have to say the restricted parameters they gave them weren’t worth a damn.
- Bnshsysjab 7y ago
  Fwiw real breaches don’t care about parameters. I know the law doesn’t see it that way, and the pentesters probably should have cared a bit more but most contracts I see basically caveats reports to say ‘and any related systems’ which gives something that will cover basically anything that would be considered ‘reasonable’ in the court of law. The purpose isn’t to be an asshole, it’s to actually raise issues when you’re otherwise limited by sleazy performance-paid project managers trying to limit your scope to basically nothing.

rhinoceraptor 7y ago

It seems like physical pentesting is more about putting on a show. If you can break into the network remotely, most people have a hard time understanding the technical details. But if you can break into a courthouse undetected, now you have something everyone understands.