Re: My Frustrations Step Two

On Thu, Dec 18, 2008 at 7:27 AM, Adriel T. Desautels
<ad_lists@xxxxxxxxxxxxx> wrote:

So it appears to me that the solution to this problem is to provide the
customer with ammunition so that they can quickly shoot down the fraudulent
security experts and properly identify the real ones. There are different
services, different classifications of service, different threat levels,
etc. If our customers knew how to identify what they needed, they could use
that to choose a good provider with much more success. But thats the real
problem isn't it? Our customers aren't security experts and as a result they
don't know what they need...

I think that you're on the right track here, insofaras customer
awareness is the key to differentiating expert pen-testers from people
who charge money for Nessus scans. (To that point, using a scanner
isn't a differentiator between a poseur and a real pen-tester, but
*only* using a scanner is probably the big one.) But this is far from
a silver bullet. As I pointed out the last time we discussed this
topic, there are customers out there that want - or are required to
have - a report from a third party that shows hat they're secure. And
they're not willing to pay much, so they're not going to get much.

For a Netragard, or an InGuardians, or an IOActive, or an Immunity, it
is simply not worth their time to work with clients who want to do
security on the cheap. They staff experts, and they pay for it. As a
result, so must their clients, and it's clear that they don't have
problems getting clients who are willing to pay for access to their
experts. But if somebody's willing to spend money, somebody's also
likely willing to take it, and that's not going to change no matter
how much you educate the customer. Unqualified people will continue
to do IT security work for the duration. And for those that propose
licensing as a solution, ask an attorney how effective that's been in
their field.


So, what questions can we arm our customers with so that they can weed out
the Frauds?

I think that this is less about general education and more about brand
awareness. It is a business, after all. In our industry, you build
brand awareness by publishing new research and by sending your experts
to present at conferences where they can be seen. Oh, and you put
your logo on all of it. :-)

The end result will be customers who want, and can easily find,
upper-echelon talent and service on one end, and customers who care
only about cost on the other, with a pretty big middle defined by
various organizational constraints. Frankly, I'm not sure we aren't
already there.

PaulM

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------

Relevant Pages

  • Re: [fw-wiz] Security dumming down - the kings clothes
    ... these networks we have: "it's a trifle chaotic out there". ... responsible for the security portion of this overall process our ... me that our greatest weakness as an industry is not that our customers are ... >>marketing or rhetoric PhD. ...
    (Firewall-Wizards)
  • RE: Charging customers on security
    ... Although far from secure, we do our best to secure it as good as possible. ... I agree that security is the last thing developpers have time for, ... if we don't add, they won't pay the fee next year... ... We already made our customers sign agreements that we didn't take ...
    (SecProg)
  • RE: Charging customers on security
    ... Customers get what they're willing to pay for. ... additional cost of producing a secure and working product, ... >> Charging for security of your own applications? ...
    (SecProg)
  • Re: How do you monetize your skills?
    ... organizations that were dedicate on only the Information Security ... In sales you'll learn that customers that "want" your product/service ... market customer to reach in all of marketing/advertising. ...
    (Pen-Test)
  • Re: Data Center Theft
    ... went wrong, change security and procedures. ... NOT lie to your customers, and put them in the positions that CI Host ... So how is it possible that the facility has been robbed ...
    (bit.listserv.ibm-main)
Quantcast