@Jimmy9008 said in Pentest - Who would you recommend?:
@IRJ said in Pentest - Who would you recommend?:
@scottalanmiller said in Pentest - Who would you recommend?:
@IRJ said in Pentest - Who would you recommend?:
@scottalanmiller said in Pentest - Who would you recommend?:
@Carnival-Boy said in Pentest - Who would you recommend?:
@IRJ said in Pentest - Who would you recommend?:
You definitely don't want a pen test, you need a security assessment. There will be plenty of things to fix, and after securing the network then you could do a pen test the following year.
Same thing. What do you think an assessment will do that a pentester won't (and vice versa)?
One is only testing penetration from a set of attacks. Most security vulnerabilities are not penetration so aren't part of that test (like SQL Injection is not penetration) plus it tests attacks, not risks.
Example.. which tells you how long it will take to break through a door, hitting it with a hammer or knowing a lot about the door? If you know enough about the door, you know where it is weak or if the hinges are about to give out. If you just hit it with a hammer, you might get lucky and get in on the first swing or you might never hit it hard enough to break the hinge.
Both are valuable, but one tells you a lot more, typically.
Yes, alot of people use security assessment and pentesting as interchangeable terms but they are much different. Pen testing is only done when you feel you've already covered everything found on a security assessment.
Yes, doing both is definitely good. But if only doing one, it's the assessment that I'd want.
Especially in an org that I am assuming has not run any vuln scans. They are going to have over a year's worth of work if they are lucky.
We would like to see what could be cone 'as is'. Just because we have not had a security report done, does not mean one should assume we would fail it. We have a lot in place and fixed processes, of course, nowhere is 100%, but i'd like to see what an external tester could do with nothing more than the company name. That's all an actual attacker would have.
Unless the attacker was an internal attacker//had links to someone internal to know a bit more...? Never forget that the biggest vulnerability in any business is the fleshy thing in front of the screen.
