3 ms·
> Lying is not an embellishment or puffery, it's a lie. Engaging a company for a 3 day pen test that's totally insufficient, that would be an embellishment. I
by mjr00 3y ago
> Lying is not an embellishment or puffery, it's a lie. Engaging a company for a 3 day pen test that's totally insufficient, that would be an embellishment.
I agree, but if the RFP question was phrased "have you done penetration testing?" then that leaves a lot of room for embellishment. If the question is "do you have SOC2 certification?" and you answer "yes" untruthfully, then that is a lie. If they ask for the SOC2 or pentest report and you give them a falsified document, that's where you're (probably) committing fraud.
> One of the most important part of pen tests is that they are external.
AWS/Google/etc have internal security teams doing their pen tests, so no, this isn't true.
> Just doing your job as an engineer and looking for bugs is not a pen test.
What about an engineer spending an afternoon running ZAP[0]?
> It's like saying, "what is an audit really? We have accountants and they check our books for anomalies."
Yeah, which is why you don't just ask a company "do you keep track of your finances?" if you're investing in them, you request external auditors.
[0] https://www.zaproxy.org/ https://www.zaproxy.org/
- maxbond 3y agoI have literally worked alongside external pentesters for some of those organizations you allude to. I still remember their codenames. They might have the scale to have internal pentesters nearly as isolated as external pentesters. A ten person startup definitely does not. Regardless of what tools you use, an internal pen test isn't the same. Do internal accountants use different tools than KPMG? Probably not. The RFP likely did contain more precise language. I encourage you to reflect on your position. It's very odd to me that your attitude is, "if the customer didn't want to be lied to, they should've tied me down better, because I'm like a djinni who will twist your words against you if there's the slightest ambiguity." I understand the sentiment that RFPs and contracts need to be locked down. I don't understand the sentiment of, "they had it coming."
- l33t7332273 3y ago> Regardless of what tools you use, an internal pen test isn't the same It isn’t the same as an “official” pen test for a 10 person company with non-specialists, sure. But the document, to our knowledge, didn’t ask if they had some specific form of pen test. > because I'm like a djinni who will twist your words against you if there's the slightest ambiguity. They aren’t twisting anything. If a quick and informal pen test meets their definition then they should be more specific.