Re: Pen-testing - pricing model

[Kish Pent <kish_pent () yahoo com>]

Hey intel96,

I know that many or most consulting firms give only a
pen-test report [hard-copy, or password protected pdf
file with "encrypted file container"] and a meeting
where the testing team,manager, present their findings
and the upper management discuss regarding the test. 

Now most times, people come up with "executive
summary" and technical summary, and the HR asks you
... "okay, what about the "value"" of this pen-test ?

What did we "gain" because of this "security-test" [as
per their language]... Then we give the ROI analysis
worked for their "infrastructure" [which includes
security controls, network devices, and their boxes]

This is done by us "for every pen-test" to keep the HR
or the upper management satisfied about the "value"
they get.[time-value tradeoff].

Regards

PS: This post is a bit off-topic, so excuse me list ;)

--- intel96 <intel96 () bellsouth net> wrote:

> I have never seen a ROI analysis in a pentest
> report.  How do you
> perform such an analysis?


Kishore
Penetration Tester
Smart Security
17/1,Upstairs,Sarojini St,
T.Nagar , Chennai - 600 017
Phone: 91 98841 80767

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------