Presentation title: Incresing the value of Security Testing presented at BsidesDFW2013 2013

by Chris Nickerson,

Summary : Compliance and Best Practices tell us to do a Penetration Test, but there is not real definition. We are asked to do Vulnerability Scanning, but are the scores relevant? What about this huge audit we went through? All those tests and all those boxes checked.... is our company more secure?
As a tester and defender I am SICK of seeing people pay for testing and have no idea what the tester did, how they did it, or what value it provides. Unless we follow a methodology that is repeatable, understand the business and its assets, and work on both the Red Team AND Blue Team.....we are defending our networks with the same stacks of cash the attackers are trying to steal.
This session will talk about practical testing and defense, getting the most out of your testing dollar, and < surprise face> how to track the growth of your InfoSec program from its management systems all the way out to the magical question "How are we REALLY?"