Re: Gartner's Security 3.0

Gentlemen,
really, I guess that is absolutely all about which points a pen-test
report must be responsible for.

Should it only cover one static network scene, reporting only
vulnerabilities detected in a given moment? That is cheap work. I
don't think it's the ideal.

A network's dynamic nature and its impact on corporative environments
creates the necessity of a more sensible pen-test approach,
forecasting not only future vulns but also the trouble it could cause
in terms of financial losses in business, perhaps even considering the
companies' image. And by that, I also mean: adopting insecure
technologies today in order to increase enterprises' productivity can
ruin them as hell tomorrow.

A professional audit/pen-test today shoud make use of the cautious
balance between security and productivity and must include financial
analysis, don't you think(?).

That would justify increasing valorization to our market.



Yours faithfully,

On 10/17/07, Santiago Barahona <sant-bar@xxxxxxxxx> wrote:

Hi all,

I agree with you and with the 5% also... from my perspective it depends on
the maturity level of the companies. The more mature an organisation is,
the less need to spend on security. That'd be because security would be
completely embeded in all processes... I guess that 5-8% would be in
maintenance, audits, etc...

But of course, that's only my guess... I'll try to get my hands on that
paper...

I agree with the fact that most COs try only to "pass the audit" as you
say. The problem is that it is not easy for us to justify "security" by
itself, we have to justify it as a business need (security must exist only
when it is needed). Security must be aligned with (and aid to reach) the
business' objectives.... shouldn't it?

Regards,

Santiago



On Wed, October 17, 2007 3:55 am, xelerated wrote:
I think it should be far more.
And not even from a pen tester perspective.

If you think about it, the pen tester has the easy job.
Its the people that have to secure the network that have
the hard job. Think of all the vectors that are never addressed,
either because of its not thought of, or its not part of a regulation
or audit.

How many companies focus on securing desktop (or logging for that matter)
as much as they do servers? Sure there are policies and common sense
to lock the desktop, but a fair amount the non IT, and older folk
dont even consider it.

I personally think that the #1 problem in INFOSEC today is many companies
do
not look at the big picture. Its all about "passing the audit" not
REAL security.

Just because you can pass an audit does not mean you are any more secure
than the next company.

Chris
OPST, CISSP, CNDA


On 10/16/07, M.B.Jr. <marcio.barbado@xxxxxxxxx> wrote:
Pentesters,

Gartner's recently -- during its 2007 IT Security Summit -- released
it's new corporative Information Security approach, named "Security
3.0".
Basically, it suggests that 8 percent (and no less whatsoever than 5%)
of the companies' IT budget be focused on security.

It is something no doubt but personally I think it could be more, say
10%.

The thing is:
how are you, as a pentester, feeling such, concerning your incomes?


Yours faithfully,



--
Marcio Barbado, Jr.
==============
==============

"In fact, companies that innovate on top of open standards are
advantaged because resources are freed up for higher-value work and
because market opportunities expand as the standards proliferate."
Scott Handy
Vice President Worldwide Linux and Open Source, IBM

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------







--
Marcio Barbado, Jr.
==============
==============

"In fact, companies that innovate on top of open standards are
advantaged because resources are freed up for higher-value work and
because market opportunities expand as the standards proliferate."
Scott Handy
Vice President Worldwide Linux and Open Source, IBM

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • RE: death of the security community
    ... Well, not so much that they do not want to be secure, but rather that we ... situation where security professionals are seen to being crying wolf. ... the term script kiddie was formulated over a decade ago by Marcus ... wording of Audit is used. ...
    (Security-Basics)
  • Re: Ten least secure programs
    ... it's probably better you leave the topic alone ... I said I do not have security issues with the programs I code. ... I didn't realize you were a Linux user, ... > the most widely used and secure UNIX flavors? ...
    (Security-Basics)
  • "An Asp.Net accident waiting to happen" - Draft article
    ... In a time where Security ... in shared hosting environments. ... technologies that allow the creation and deployment of secure ... IIS 6 web server and windows 2003 also provide some tools to deploy ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Why Easy To Use Software Is Putting You At Risk
    ... I do agree that the additions and changes to Solarius will make it more secure and that this is good. ... Why Easy To Use Software Is Putting You At Risk ... instead I would say that the view that security is ... Four Construction Workers Died after Crane Collapse in Toledo, ...
    (Security-Basics)
  • Why Easy To Use Software Is Putting You At Risk
    ... Anyone who has been working with computers for a long time will have noticed ... because DNS does not configure properly or security permissions are relaxed ... Is It Also Secure ... guarantee that no one really knows for sure, not even Microsoft developers. ...
    (Security-Basics)