Hey All,
Whether you pentest for a living or are a vendor, I'm curious to find
out what kind of gear you've come across that crashes rather easily.
I'm doing some research with the goal of making a business case for some
kind of 'Enterprise VM tested' product certification, and seeing if I
can get my employer to sponsor or make a push for it. It would take the
form of a vendor neutral not-for-profit company/foundation of some kind.
The idea would be that all VM (and related product) vendors would be
invited to pool their products. Care would be taken so that there's no
way for any one foundation member (or subgroup thereof) to have undue
influence, no leak of proprietary information between members, and it
couldn't be abused as a marketing tool by the members.
So far I'd like to see the foundation consist of Qualys, eEye, nCircle,
Nessus/Tenable, Foundstone, Rapid7, and I'm trying to think of others as
well; c'mon, throw me some more names! We'd also test with utils like
nmap, amap, etc. Anyone who wants in can get in, small or large. It
should be friendly.
Then, submitter-vendors who make network enabled gear would submit it to
the foundation for testing, and we'd scan the shit out of it and let
them know if it got knocked over, and if so, how. Then the submitters
could take this information and improve their product. Everyone wins, etc.
The most common crashing device I've come across are printers, most
commonly HP, although maybe that's because they have a larger market
share in my experience. I've seen Canon and Lexmark too. And a few other
things here and there, of course, as has anyone in this field (and if
they haven't, I suspect they aren't telling the whole truth).
Thoughts, opinions, suggestions are welcome, particularly those from
other vendors.
Cheers,
Byron
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
