http://blog.clearnetsec.com/articles/tag/penetrationtest en-us 40 When competing for security assessment projects it is often painful for the customer to distinguish the level of service or effort between proposals. We used to respond to RFPs with the intention of satisfying all the services the customer is soliciting – of course in the end in nearly every case that isn’t what wins the bid. <p /><br /> We came up with a quick flow diagram to illustrate the differences in the level of effort between network-based security assessments. This has helped us tremendously with clients and with keeping the playing field level. It’s not complete or exact by any means, but it works. <p /><br /> <img src="http://blog.clearnetsec.com/files/Flowchart_for_Security_Assessments.jpg"> <p /><br /> We add some verbiage to help customers relate it to real world: <p /><br /> <b>Sample attacker profile:</b><br /> <span class="orange">Basic</span>: Attacker spending minimal effort; downloading free 'hacking' tools and running them with minimal attention <br /> <span class="navy">Intermediate</span>: A motivated attacker spending more time and resources with greater attention to detail and actively searching for a weakness <br /> <span class="red">Advanced</span>: A serious attacker with intent to harm or steal information assests <p /><br /> <b>Security assurance profile:</b><br /> <span class="orange">Basic</span>: Minimal; relies on a limited set of tools to discover weaknesses <br /> <span class="navy">Intermediate</span>: Good; relies on running many tools with overlapping functions, specialty tools, tuned for bandwidth and latency conditions, and includes manual investigation, validation, and research into findings <br /> <span class="red">Advanced</span>: Excellent; goes beyond Intermediate to prove the existence of vulnerabilities, includes checking non-public domains for the existence of 0-day exploits <br /> Tue, 19 Sep 2006 15:21:00 -0600 urn:uuid:02e7642e-02ab-4df6-b9bc-c66aa29c2d21 tate@ClearNetSec.com (Tate Hansen) http://blog.clearnetsec.com/articles/2006/09/19/competing-for-network-based-security-assessments security Audit ClearNet Security Tate Hansen vulnerability security assessments penetration test scan