RE: Business justification for pentesting

From: Omar A. Herrera (omar.herrera_at_oissg.org)
Date: 08/31/05

  • Next message: nightstorm_at_hushmail.com: "P2P Tools and Shared Directory Tools" 
    To: <pen-test@securityfocus.com>
Date: Tue, 30 Aug 2005 18:48:41 -0500

    > -----Original Message-----
    > From: sectraq@gmail.com [mailto:sectraq@gmail.com]
    > hi all,
    >
    > a few classic question that i would appriciate any answers for.
    > 1- i would like to briefly know how to quantify information assets. In
    > other words, i hear a pentester say: if a hacker breaks in ur network, u
    > will loose up to 40000$ for example. how can he come up with such figures?
    >
    > 2- are there any other means to justify pentesting for management except
    > for $$$?
    >
    > 3- are there any official statistics, figures etc. for justifying
    > pentesting. ther more official it is the better.
    >
    > 4- any other information you guys might find helpful in justifying a
    > pentest would be appriciated.
    >
    > thnx in advance for ur help.
    >
    > T.N

    In order to provide more useful information to justify you pentest, you will
    need to get some information from your client first. For example, what is
    the cost of loosing this information or staying out of business for a couple
    of hours? Many clients will even feel you are bragging if you just show them
    numbers. However most will appreciate the fact that you recognize that you
    don't know the details of their business but know your own business well and
    are able to use that knowledge in other environments after you learn from
    them.

    A better approach in my opinion is to give your potential client the tools
    for them to do the math. In many cases, it is not necessary to provide a
    number. For example, most banks know very well the risks of having certain
    types of incidents. You can also remind them of what has happened to other
    similar companies (e.g. CardSystems case for e-banking and e-commerce). In
    any case, doing a reasonable research of your client and their business
    before showing up is advisable.

    Another good reason for not providing a number is that you will eventually
    deny being liable for intrusions an incidents after your pentest. Simply
    because the pentest can't guarantee that this won't happen or that you will
    discover all and every vulnerability out there.

    So, It is ok to say: "Look, these are the risks and this is what might
    happen to companies like yours, let me check out to see if there are any
    vulnerabilities that are exploitable from the outside using procedures and
    techniques similar to those of a hacker but with the benefits of having
    repeatable results, blah blah blah".

    Regards,

    Omar Herrera

  • Next message: nightstorm_at_hushmail.com: "P2P Tools and Shared Directory Tools"