6 ms·

People are paying pentesters because their payer’s policy asks them to. Of course there will be a huge market for someone with an alleged certification to run a

People are paying pentesters because their payer’s policy asks them to. Of course there will be a huge market for someone with an alleged certification to run automated tools, the value is in the box checking and report generation, not the bespoke broken website fixing.

czbond 6y ago
Obviously this is a bit of a reaching statement, some organizations understand the legal, career, and regulatory risk and proactively do it. In every org I've sat down with the head to explain those risks, I can see how it can be made priority and budget.
- Quarrelsome 6y ago
  will it survive budget review though?
  - czbond 6y ago
    Usually does - if I can get in front of them. Edit: Followup - here is a primer method. The exact method differs if you are talking with leaders, or middle management, or space occupiers. (Leaders as in intelligent, aggressive forward thinkers). You have to make it personal, and show them how the thing that they care most about (eg: career, personal security, promotion, or liability exposure) is at risk; which now-a-days is a true statement.
- edw 6y ago
  Can we collectively refrain from making comments like this on Hacker News—or in any venue, for that matter? Is it that hard to read an assumed “In my experience, it is often the case that…” in front of everyone’s comment?
  - czbond 6y ago
    I was stating that I have great success showing how said items should be prioritized and budgeted, across numerous organization types, sizes, and industries - and making it happen. That is my experience, it may not be others.
- bostik 6y ago
  Let me demoralise you. There are industries [cough] where (for a good number of jurisdictions) you MUST have the pentests and other audit-like engagements conducted by a specially approved operator. Think of a royal charter. These operators have no incentive to invest in proper skills. So they don't. They can charge almost anything they like. And sure enough, they do. In an industry with such massive vendor lock-ins and regulatory capture regimes, organisationally you get to shovel a lot of money for sub-par pentests. The appetite to have yet another one, even from a known-good and reasonably priced provider, is quite hard to come by. After all, these approved providers will REFUSE to even look at a third-party pentest report, let alone let one guide their own testing. So in aggregate the existence of these approved providers and their level of competence degrades the security posture of entire business domains. Macchiavelli would have been proud.
  - czbond 6y ago
    Absolutely agree.
  - tru3_power 6y ago
    This annoys the hell out of me. The whole security theater /checkbox checking stuff is depressing.

czbond 6y ago

Obviously this is a bit of a reaching statement, some organizations understand the legal, career, and regulatory risk and proactively do it. In every org I've sat down with the head to explain those risks, I can see how it can be made priority and budget.

Quarrelsome 6y ago
will it survive budget review though?
- czbond 6y ago
  Usually does - if I can get in front of them. Edit: Followup - here is a primer method. The exact method differs if you are talking with leaders, or middle management, or space occupiers. (Leaders as in intelligent, aggressive forward thinkers). You have to make it personal, and show them how the thing that they care most about (eg: career, personal security, promotion, or liability exposure) is at risk; which now-a-days is a true statement.
edw 6y ago
Can we collectively refrain from making comments like this on Hacker News—or in any venue, for that matter? Is it that hard to read an assumed “In my experience, it is often the case that…” in front of everyone’s comment?
- czbond 6y ago
  I was stating that I have great success showing how said items should be prioritized and budgeted, across numerous organization types, sizes, and industries - and making it happen. That is my experience, it may not be others.
bostik 6y ago
Let me demoralise you. There are industries [cough] where (for a good number of jurisdictions) you MUST have the pentests and other audit-like engagements conducted by a specially approved operator. Think of a royal charter. These operators have no incentive to invest in proper skills. So they don't. They can charge almost anything they like. And sure enough, they do. In an industry with such massive vendor lock-ins and regulatory capture regimes, organisationally you get to shovel a lot of money for sub-par pentests. The appetite to have yet another one, even from a known-good and reasonably priced provider, is quite hard to come by. After all, these approved providers will REFUSE to even look at a third-party pentest report, let alone let one guide their own testing. So in aggregate the existence of these approved providers and their level of competence degrades the security posture of entire business domains. Macchiavelli would have been proud.
- czbond 6y ago
  Absolutely agree.
- tru3_power 6y ago
  This annoys the hell out of me. The whole security theater /checkbox checking stuff is depressing.