3 ms·
Aren't negative results already monetized, through standard pen-testing servcies? The usefulness of a negative result is dependent on the thoroughness and skill
by albntomat0 6y ago
Aren't negative results already monetized, through standard pen-testing servcies? The usefulness of a negative result is dependent on the thoroughness and skill of attacker, while a positive result is useful no matter who submits it.
An unknown person finding a vulnerability has clear value, but a negative result from an unknown person doesn't mean much.
- contravariant 6y agoA negative result has value as long as it's clear what vulnerabilities have been tested. Of course it's pointless if you don't trust the person testing it, but that's always going to be a problem. I guess you might need to have reproducibility to make it truly useful.
- albntomat0 6y agoThat seems to me to be mostly limited to automated tools, or checklist level evaluation? The good/dangerous bugs require creativity and deep system knowledge to find, which is hard to trust that an unknown person has.
- ozim 6y agoThen comes risk management and I would tell you "good bugs that require creativity and deep system knowledge to find" are not dangerous. It is sexy and all to sell "we hacked you using emacs through sendmail by the moon phase exploit that happens every 2 months". But really how many people will be able to exploit that? My company is not target of a state sponsored actors. Automated tools, checklist evaluation and decent administrators will be good enough for most of companies. Ordering pentests from time to time is good practice to check if administrators are doing their job as in "trust but verify".
- bashwizard 6y agoIt's not. Running scanners and report scan results won't get you paid so it's a complete waste of time. Trust is easy. You either have a proof of concept and can show impact in your report or gtfo basically.