ddj: beyond the badnessometer

[muscetta at gmail.com (Daniele Muscetta)]

On 7/13/06, Gary McGraw <gem at cigital.com> wrote:
> 3) never use the results of a pen test as a "punch list" to attain
> security


You are right, but very sadly, that's how it gets used by a lot of
companies....
"hey, the pen testers found problem 1, 2, 3 - we fix those, we are fine". No
way. But still.... I've seen this done in a lot of places....

Best,

Daniele
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://krvw.com/pipermail/sc-l/attachments/20060714/7d662d11/attachment.html