hi,
thanx to everyone for brain-stroming on this point.
i asked this question cause i failed to understand why certain clients are bent
on penetration testing cause the results totally depend on the skill set of the
person/company performing the penetration testing.
I am of the opine that the companyx should get a two vulnerability assessments
(not penetration testing) done.
Scan 1: With its preventive and reactive controls switched off (IPS/IDS/HIPS
etc). Results ranked not on technical ranking (most tools/VA companies
tabulate on tech rankings) but on business impact ranking.
Scan 2: with the preventive and detective controls switched on (IPS/IDS/HIPS
etc). Again results ranked on business impact rankings.
The second result with test the effectiveness of security controls in place.
Based on the two scans, the companyx should go about plugging those
vulnerabilities in phased manner:
Phase I: Plug those which could be "identified" (not necessarily exploited)
inspite of security controls switched on and have high business impact.
Phase II: Plug those which could be "identified" (not necessarily exploited)
inspite of security controls switched on and have medium or low business impact.
Phase III: Plug those which could be "identified" (not necessarily exploited)
when security controls were switched off and have high business impact.
(To ensure "safety" even when any preventive or detective control fails)
Phase IV: Plug those which could be "identified" (not necessarily exploited)
when security controls were switched off and have medium or low business
impact. (To ensure "safety" even when any preventive or detective control fails)
What say ppl. Does this approach make any sense into the chaos?
Regards
