Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: Business justification for pentesting
From: Kevin Reiter <tux () penguinnetwerx net>
Date: Fri, 02 Sep 2005 19:26:52 -0400

Craig Wright wrote:
A pen test does not and by nature cover the requirements for SOX or any of the other areas.
A Pen test can be used as a part of an audit but is not an audit. This is a common misconception, but it is definately wrong. I see this a lot (being a manager in a chartered firm). The audit requirements can not be satisfied by a pen test and any firm that believes this is deluding themself Craig

-----Original Message----- From: Kevin Reiter [mailto:tux () penguinnetwerx net] Sent: Wed 31/08/2005 3:18 PM To: Cc: sectraq () gmail com; pen-test () securityfocus com Subject: Re: Business justification for pentesting
        
        
        Don't forget about federal regulatory compliance issues, if your business
        falls under those categories (SOX, GLBA, etc.)
        
        Your company may even be *required* to have a third-party audit/test done
        periodically (i.e. once per year) in order to be "certified" to meet those
        federal requirements, as well as other items put in place (IDS,
        monitoring, etc.)


I wasn't meaning a pen test all by itself, which is why I mentioned "audit" as well.

I also never said that a pen test would cover the requirements for any certain area, but "could be a requirement" for one or more (meaning, in addition to), as well as other items.

My apologies if my wording was wrong in the original post.

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault