ClearNet Security : True penetration testing?

Comment on True penetration testing? by Andre Gironda

Mon, 05 May 2008 04:15:13 -0600

One day in the not-so-distant-future, exploits will reveal their true nature to the public – that they are weapons of mass destruction.

However, in this case – I think it means ‘overflow with A’s’, instead of “Rapid Penetration Testing” (c) CoreSec. I’m sure the PCI SSC will correct me, and later specify that only Core Impact used by a monkey qualifies (probably something as close to a real monkey as possible).

“resources must be experienced penetration testers”

What does that mean?

Tate, my man, you should know what this means. The PCI SSC will specify the exact requirements for this once they figure out how to monetize it. In other words, they need to figure out which certification vendor to get into bed with so that they can take a cut of the money.

Also see: ASV + Qualys, Requirement 6.6 clarification + F5/Citrix, et al

Comment on True penetration testing? by Tate Hansen

Mon, 05 May 2008 10:44:12 -0600

@Andre: lol, my bad, you’re exactly right. I was so wrapped up in the skills thing I forgot about the money thing. Doh. Feel free to deliver a sensibility roundhouse kick to my head anytime! :)

Comment on True penetration testing? by LonerVamp

Tue, 06 May 2008 14:26:16 -0600

Just wait! They’re going to get into bed with some Certified Ethical Hacker cert and that’ll be the criteria!