5 ms·
> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Funny enough, th
by Kalium 6y ago
> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's.
Funny enough, this thought process shows a failure to understand process and internal influencing. Quite often, the things found by a basic pen-test are known internally. Research will reveal long, boring discussions that end with someone like Bill dismissing things as not important and the risk acceptable.
What the paid-for report does it makes the risk visible, documented, and something the company may have to show to customers or partners. Now it's gone from something that can be shrugged off to something expensive and embarrassing. Bill has to explain why his opinion should matter more than those of the biggest customers. Now it's something that is much easier to prioritize.
Big management often doesn't value unpleasant or critical feedback from below. Once it's advice that's been paid for, its value jumps. After all, if you're not going to listen then why did the company pay the big bucks for it?
- gruez 6y ago>What the paid-for report does it makes the risk visible, documented, and something the company may have to show to customers or partners. Only if there's a lawsuit and it shows up on discovery. Otherwise there isn't really anything preventing it from being buried.
- Kalium 6y agoSometimes it crops up in vendor review or similar. I've definitely found myself reviewing pen-test reports for exactly that reason without a lawsuit or discovery. Needless to say, having a bad pen-test report and then burying it would look extremely bad.
- GekkePrutser 6y agoThis is a really good point. I have actually seen that happen. I just wish we could get our own point across (at a level higher than myself) sometimes without having to do this :)
- Kalium 6y agoIn that case, I have good news! Well, good-ish. If this happens often enough, higher-ups sometimes get sick of being blind-sided by it. They start being pro-active about addressing security issues and planning projects to pay down tech debt. Doesn't always work, but it's more likely to work with a far-sighted exec than a quarterly-minded one.
- jollofricepeas 6y ago[secexec here with F500 company.] Over time every security executive learns that there’s only three important things in security: - How big is our cyber policy? - How do we make sure the insurance company pays out? - Will our financial growth and policy offset the maximum potential losses if we decide not to roll out security tool X or patch Y? That’s really it. When growth and insurance won’t cover it then you’re plugging holes until the equation balances itself out. Everything else is theater. Doing anything other than the above ends your career...quickly.
- someone3125 6y agoSo what do you think about the Garmin hack? How did their secexec fail? Did they not follow this model?
- Kalium 6y agoNaively, I would expect that an insurer is less likely to pay out if a basic pen-test suggests negligence on the part of the company.
- jollofricepeas 6y agoSort of. Pentests are a joke - a compliance activity and nothing more. As the client I get to pick the vendor, determine scope and influence the criticality of findings in the final report. Insurers don’t care about anything until you have a breach and a claim. They look to see whether you have the controls mandated in the policy and... Whether your attacker used a nation-state toolkit if so then they don’t have to pay. Most cyber policies will not protect against “acts of god” or “acts of war” without paying top dollar and having a cap on damages.
- user5994461 6y agoThey will also look for gross negligence. The worm hit out-of-support Windows XP machines that the company couldn't bother to upgrade in the past 10 years. No compensation.
- 6y ago