Pen testing: Access denied
- Article 4 of 33
- SC Magazine, September 2006
How can you be sure your security works unless someone tried to crack it - and failed? Rob Buckley delves into the world of penetration testing.
Page 1 | Page 2 | Page 3 | All 3 Pages
There is a UK certification that requires a complete background check: the Government's Communications Electronic Security Group CHECK scheme.
CHECK certification ranges from 'red' through to 'green' for full clearance.
All levels involve a viva and a practical demonstration of pen testing skills.
And passing once isn't enough, regular recertification of both individuals and company are required as well.
In lieu of any other pen testing standard of ability and trustworthiness, CHECK Green status has now become part of almost all pen-testing tenders.
There are, however, many pen testing companies that do not have this status at present, with even IBM only getting CHECK Red.
Uncertain future
Uptake of pen testing services in the UK is still quite small. Steven Cox, principal consultant for security management at Computer Associates, admits that none of the company's clients have ever asked for the service or even recommendations. Although it is being forced on some, most companies feel their exposure to risk doesn't warrant the costs and time a pen test will take. Those who have already been broken into often feel differently, however.
Ultimately, pen testing exists in a slightly opaque world where it's sometimes hard to separate the good, the bad and the downright unnecessary.
Add in the proposed amendment to the Computer Misuse Act (see box p35), and the future for pen testing as a commercial enterprise, at least in its current form, starts to look a little uncertain. Despite this, for some CTO's there is always going to be an annoying voice that says: “How do you know your network really is secure? Have you tested it?”. As long as there is doubt, there will be a desire for pen testing.
Page 1 | Page 2 | Page 3 | All 3 Pages