Home page logo

pen-test logo Penetration Testing mailing list archives

Re: Business justification for pentesting
From: Kevin Reiter <tux () penguinnetwerx net>
Date: Fri, 02 Sep 2005 19:26:52 -0400

Craig Wright wrote:
A pen test does not and by nature cover the requirements for SOX or any of the other areas.
A Pen test can be used as a part of an audit but is not an audit. This is a common misconception, but it is definately wrong. I see this a lot (being a manager in a chartered firm). The audit requirements can not be satisfied by a pen test and any firm that believes this is deluding themself Craig

-----Original Message----- From: Kevin Reiter [mailto:tux () penguinnetwerx net] Sent: Wed 31/08/2005 3:18 PM To: Cc: sectraq () gmail com; pen-test () securityfocus com Subject: Re: Business justification for pentesting
        Don't forget about federal regulatory compliance issues, if your business
        falls under those categories (SOX, GLBA, etc.)
        Your company may even be *required* to have a third-party audit/test done
        periodically (i.e. once per year) in order to be "certified" to meet those
        federal requirements, as well as other items put in place (IDS,
        monitoring, etc.)

I wasn't meaning a pen test all by itself, which is why I mentioned "audit" as well.

I also never said that a pen test would cover the requirements for any certain area, but "could be a requirement" for one or more (meaning, in addition to), as well as other items.

My apologies if my wording was wrong in the original post.

Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]