mailing list archives
Re: Faster, smashter.
From: security curmudgeon <jericho () attrition org>
Date: Tue, 9 Dec 2008 19:35:03 +0000 (UTC)
: One technique we're doing this week with a client is taking an attack
: tree and marking it up with dollar values. I.E. if you wanted to buy an
: 0day in X component, how much would it cost?
How do you come up with that dollar value? Is it based on estimated hours
to develop a functional exploit in X component? The skill level
of the attacker writing it? The value of the information/access gained if
exploited? Probability of exploitation not being noticed and ability to
further backdoor compromised machine/network?
Dailydave mailing list
Dailydave () lists immunitysec com
Re: Faster, smashter. rauc (Dec 09)