Re: Pen-testing - pricing model

Hey,

That approach seems to make sense from your side, but not from the
customer's. Certainly, it saves them the time and effort, but does
introduce an element of conflict of interest.

It seems like a clueless approach to ask your "vendor" to provide a ROI
analysis of their own work. While I trust you will perform this
adequately, as a customer, I'd be paranoid enough not to take your word
for granted, but rather have the security responsables (security officer,
IT manager, some tech guys who know the network well....)come up with that
analysis.
Eventually at that stage the analysis could then be sent to you to further
comment and elaborate on, if desirable or bring up elements the customer
missed.

Just my 0.02EUR ;)

Kind regards,

Roger

On Sun, December 17, 2006 10:27 am, Kish Pent wrote:
Hey intel96,

I know that many or most consulting firms give only a
pen-test report [hard-copy, or password protected pdf
file with "encrypted file container"] and a meeting
where the testing team,manager, present their findings
and the upper management discuss regarding the test.

Now most times, people come up with "executive
summary" and technical summary, and the HR asks you
... "okay, what about the "value"" of this pen-test ?

What did we "gain" because of this "security-test" [as
per their language]... Then we give the ROI analysis
worked for their "infrastructure" [which includes
security controls, network devices, and their boxes]

This is done by us "for every pen-test" to keep the HR
or the upper management satisfied about the "value"
they get.[time-value tradeoff].

Regards

PS: This post is a bit off-topic, so excuse me list ;)

--- intel96 <intel96@xxxxxxxxxxxxx> wrote:

I have never seen a ROI analysis in a pentest
report. How do you
perform such an analysis?


Kishore
Penetration Tester
Smart Security
17/1,Upstairs,Sarojini St,
T.Nagar , Chennai - 600 017
Phone: 91 98841 80767

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------




--
Life is 10 percent what you make it and 90 percent how you take it. -
Irving Berlin

Relevant Pages

  • RE: Re: Generating awareness amongst IT staff
    ... i think this wouldn't make the staff so ... pretend they were doing IT security audits. ... Best is to convince upper management it is in their be$t intere$t to ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • RE: Informing Companies about security vulnerabilities...
    ... As to "Anyone else find this appalling?" ... As for software glitches - who remembers THERAC-25....? ... Informing Companies about security vulnerabilities... ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: C# Exceptions
    ... What attack scenarios could be possible on such an application? ... > Are these issues really a security threat for a desktop application? ... > this application gets from its web services. ... > Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Informing Companies about security vulnerabilities...
    ... security vulnerabilities... ... the vulnerable web apps I use for class. ... I go to a live public website or two during the class and we talk ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • RE: Blue Team ROE
    ... These types of constraints are a way to create the illusion of due ... diligence in that they are having an outside company perform a security ... the audit by client constraints. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)