Re: pen test

Brian,

A vulnerability assessment is completely different as well. Yes, you can assess the vulnerability from a technilogical standpoint of your host. For example, an open port, let's say, port 80 is open on your host. What you are looking for is a vulnerability, port 80 "can" be vulnerability. My "want" to attack that port can, and the vulnerabilities associated with port 80, create the exploit. Basically, a vulnerability assessment is a test to see what ports are open and if any are open are they vulnerable to the attack. After which you begin to label the likelyhood, high, med, low or scale it 1-10.

You are not wrong about the laws, such as PCI compliance that want you to testprocess, procedures and technology, but PCI is more than just testing ports, its identify process associated with how you handle personal identifiable information, privacy practices, physical access to servers, procedures, etc. Port scanning for vulnerabilities is a component of the overall compliance test.

You cannot ask your host to subvert there security measures but they will certainly deny you, you can however, ask that you run security scans because there are services for this such as comodo and scan alert.

I am well aware of the security certs out there and the C|EH as I am a certified ethical hacker among sevaral other security certs, I just don't add them on because 1) there are guys with no certs that are just as good and 2) they mean I passed a test. From my answers I hope you can judge me and not my certs.

Having said that, I hope I clarified some of this for you and if not feel free to respond back.

Cheers!

Mike

Michael R. Martinez
TF: 800-987-7307

-----Original Message-----
From: "Worrell, Brian" <BWorrell@xxxxxxxxxxx>

Date: Tue, 11 Dec 2007 07:13:41
To:<mike@xxxxxxxxxxxxxxxxxxx>,"Marty Resnick" <marty@xxxxxxxxxxxxxx>,<listbounce@xxxxxxxxxxxxxxxxx>,"security-basics" <security-basics@xxxxxxxxxxxxxxxxx>
Subject: RE: pen test


Michael,

Am I wrong, but there are lots of practices and in some cases laws that
say that you need to run vulnerability assessments to be compliant.
If you were to ask you web host in writing before doing it, that should
solve the possible "legality" issue that it sounds like you talking
about.

As far as I know, White Hat hacking has never been illegal, if done
correctly and above board. If it was, why would SANS and other offer
Certified Hacker classes and certs?

Thanks
Brian

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Michael R. Martinez
Sent: Monday, December 10, 2007 7:54 PM
To: Marty Resnick; listbounce@xxxxxxxxxxxxxxxxx; security-basics
Subject: Re: pen test

Marty,

absolutely not, this is called hacking. Pen testing is actively
exploiting a server, identifying a weakness exploiting gaining access.
Are you talking about scanning ports? Could you provide a little more
detail. If you mean pen-testing, then the answer is no.

Cheers
------Original Message------
From: Marty Resnick
Sender: listbounce@xxxxxxxxxxxxxxxxx
To: security-basics
Sent: Dec 10, 2007 9:35 AM
Subject: pen test

Am I able to pen test or run a vulnerability assessment on my web
hosting company. I got the idea after reading this article.
http://www.securitypark.co.uk/Security_article.asp?articleid=260173

--
Marty Resnick
Techmaking Inc.
(877) 291-1110 (office)
(661) 209-2089 (mobile)
(805) 512-9603 (fax)
marty@xxxxxxxxxxxxxx



Michael R. Martinez
TF: 800-987-7307

Relevant Pages

  • Re: [lists] Re: What to spend on a pentest
    ... PCI pen-tests are required yearly, however the pen test must stop right at the edge of running the exploit, so you never know if it actually runs. ... So here we have an industry standard "pen-test" where the pen-test is specifically required to not penetrate. ... Information Systems Security ... You have an option to go with a managed service or an enterprise software. ...
    (Pen-Test)
  • Re: Penetration tester skill set,
    ... Both pen test and invent are creative. ... I am new to the list and also to the security. ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ... The NSA has designated Norwich University a center of Academic Excellence ...
    (Security-Basics)
  • RE: Wireless Scanning
    ... presence of these technologies first. ... start helping out the Small and Medium businesses with a Quality Pen Test ... then each of the items found can have their security tested. ... Ethical Hacking at the InfoSec Institute. ...
    (Pen-Test)
  • Re: Security Audit
    ... Subject: Security Audit ... > A zero knowledge pen test ... manner that is useful and pertinent to the client. ...
    (Pen-Test)
  • RE: honeypot in conjunction with pen test?
    ... JF>a single hole and they close it. ... Mark Tinberg), a penetration test is an attempt to violate the security ... A pen test is of little use to a client, unless they are looking for system ...
    (Pen-Test)