Home page logo

dailydave logo Dailydave mailing list archives

Re: Faster, smashter.
From: security curmudgeon <jericho () attrition org>
Date: Tue, 9 Dec 2008 19:35:03 +0000 (UTC)

: One technique we're doing this week with a client is taking an attack 
: tree and marking it up with dollar values. I.E. if you wanted to buy an 
: 0day in X component, how much would it cost?

How do you come up with that dollar value? Is it based on estimated hours 
to develop a functional exploit in X component? The skill level 
of the attacker writing it? The value of the information/access gained if 
exploited? Probability of exploitation not being noticed and ability to 
further backdoor compromised machine/network?

Dailydave mailing list
Dailydave () lists immunitysec com

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]