Pro+ Content/Information Security magazine

Thank you for joining!
Access your Pro+ Content below.
January/February 2011

The penetration tester is alive and well

The malingering debate over the viability and lifespan of penetration testing as an art form and penetration testers as a species is getting tiresome. Tiresome because those doing the arguing generally confuse terms, juxtapose vulnerability management with pen-testing, and generally don't understand what white-hats do during an enterprise poke-and-probe. Let's get it straight once and for all: Pen-testing is not dead. Some vendors and expert types would like you to believe that and will try some Jedi mind-tricks to convince you -- for only a second, hopefully -- that you can, for example, automate penetration testing. You can't. Automated scans are great and are the center spoke of vulnerability management programs. They help with asset discovery and generally are good at telling you what machines are lacking which patches and if you've got a cockeyed configuration or two. But that's not a pen-test, and too many companies are confounding that as a pen-test. Pen-tests are conducted by people who are contracted to infiltrate your ...

Features in this issue

Columns in this issue

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

-ADS BY GOOGLE

Close