Re: PCI DSS & Firewalls

I suspect my company is similar to many - a penetration test that succeeds in getting to sensitive information is the only way to get management's attention.  Otherwise, "of course we are secure.  No one has broken in" is the honest belief of managers at all levels.  No, they don't do log analysis.  Yes, that makes pen testing a political tool rather than a technical tool, but it sure does help those of us who see security as more than an assertion by people with no security training or experience.  Nothing else works.

hermit921

--- On Thu, 4/2/09, Darden, Patrick S. <[email protected]> wrote:

> From: Darden, Patrick S. <[email protected]>
> Subject: Re: [fw-wiz] PCI DSS & Firewalls
> To: "Firewall Wizards Security Mailing List" <[email protected]>
> Date: Thursday, April 2, 2009, 12:30 PM
> 
> Hmmm, no I don't think so.
> 
> Network auditor would take care of regular stuff (e.g. your
> example of
> an open telnet service).  Nessus, nmap, etc. 
> Irregular stuff will be
> there no matter what, if someone knowledgeable enough
> spends enough time
> looking.
> 
> Pen Testing has no real purpose that I can see.... Other
> than as a scare
> tactic to put someone in their place, get more money for
> security from
> admin, shame your IT department, or etc.  It is more
> of a
> social/political tool than a security instrument.
> 
> --Patrick Darden
> 
> 
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]]
> On Behalf Of
> AMuse
> Sent: Thursday, April 02, 2009 2:59 PM
> To: Firewall Wizards Security Mailing List
> Subject: Re: [fw-wiz] PCI DSS & Firewalls
> 
> Isn't the point of pen-testing to take up an attackers'
> perspective and
> hit all your defenses to see if you missed something or
> misconfigured
> something?  I mean, unless you're the only person who
> set up 100% of
> your infrastructure, how are you to know that someone
> didn't
> accidentally leave telnet open?  If you didn't write
> 100% of the webapps
> your company is using, how are you to know they don't have
> SQL injection
> flaws?
> _______________________________________________
> firewall-wizards mailing list
> [email protected]
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>