I tend to consider it in the terms of a drill. We might have all the fire
exits clearly marked, but a drill would seem to provide a good test as to
the viability of the escape plan.
I would wager that mosbunall companies that kept offices in the WTC run
regular disaster recovery drills, it appears that many of them had disaster
recovery plans... But had never proven the plan.
I think penetration testing works in a similar fashion.
-----Original Message-----
From: Matt Curtin [mailto:cmcurtin@interhack.net]
Sent: Friday, June 17, 2005 9:13 AM
To: tarunthenut@gmail.com
Cc: pen-test@securityfocus.com
Subject: Re: Why Penetration Test?
tarunthenut@gmail.com writes:
I was wondering the usefulness of a penetration testing against
vulnerability assessment for a company.
It's a good question, and while there are plenty who disagree with me on
this, I maintain that penetration testing is useful for determining whether
an organization's ability to detect and to respond to attack is in line with
its expectations.
Risk assessment will consider things like threats, vulnerabilities, and
assets, looking at the likelihood and impact of various threats exploiting
vulnerabilities to damage assets. The objective here is to determine which
risks are best accepted as a cost of doing business, which are best
transferred, and which are best mitigated against.
Technical evaluation will perform validation of the controls put in place,
whether they are working as expected. Many people (mistakenly, in my view)
call this "penetration testing").
Penetration testing, understood in this context, is very useful indeed. For
example, if your staff notices and responds to something that your risk
assessment said you're not going to worry about, it shows that you're
spending too much time and money looking at stuff in detail, or that your
risk management policy needs to be updated to reflect what is happening in
reality. On the other hand, if a penetration is attempted, noticed, and
responded to appropriately, that will show whether the policy, technology,
and people are doing all of what they should.
--
Matt Curtin, author of Brute Force: Cracking the Data Encryption Standard
Founder of Interhack Corporation +1 614 545 4225 http://web.interhack.com/
Forensic Computing | Information Assurance | Managed Information Technology
