Putting your security assessment budget on a leash while avoiding the Pentest Puppy Mill
The goal of a penetration test should be to elevate your security, not line the pocket of the pentester. In this webcast, Paul and John discuss ways to structure your pentest so that you aren't paying for shells from a Pentest Puppy Mill, but instead paying for reproducible results that will provide a baseline for future testing.
Topics:
- What a good RFP should look like
- Pentest puppy mill explained
- Following the PTES standard so you don't get a vuln report
- Explaining how the PTES standard helps organizations
- Assess yourself before the red team shows up
- Money saving tips:
- Crystalbox vs. Black
- VPN access vs. onsite
- Insist on report with ways to reproduce results to test your mitigations actually improved security
- Onsite only after external testing exhausted
- Test/QA/Dev environments vs. production
All the above should be done as if preparing for the NEXT year's pentest.
