Hi,
I can only speak for (some) Swiss decision makers of local and world-wide
operating companies/organisations. In the last two years, many clients
evaluated and chose the OSSTMM to be their methodology to follow for security
testing. These were and are the most important reasons for this decision:
1. The OSSTMM is the one and only (?) pen test methodology available that
covers all steps from project planning, project organisation, and project and
result documentation.
2. The OSSTMM is compliant with ISO/IEC 17799, ITIL, SOX, IT GSHB and many
other standards and/or guidelines. Therefore, the OSSTMM complements these
well-known standards. This point is of specific interest whenever the audience
consists not only of technical folks.
3. Attached forms define the minimal requirements (=the filled in forms) of a
OSSTMM compliant report. This implicitly warrants the quality of the testing
work.
4. The OSSTMM is tool-independent. The 'Open Source' in the 'Open Source
Security Testing Methodology Manual' means that everybody is free to use it
without having to pay a license fee.
5. The OSSTMM counts on the merits of the testers, not on (company) brands.
6. The result is a value that can be compared easily instead of the typical
'good' or 'better' feelings in comparison to competitors or industrial sectors'.
By the way: a couple of non-Swiss security organisations use the OSSTMM as well.
Yours,
Christoph Baumgartner, OPST
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com for details.
------------------------------------------------------------------------------
