Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I work for a major publicly traded company and we need some external black box pen testing done on a Win32 executable. This exe is used in a large client server infrastructure and is a central piece of our core business. It handles monetary transactions so it is vital that it is secure. The scope of work we would want audited are:

  • Protocol reversal of client / server communication.
  • General binary analysis for potential vulnerabilities.
  • Analysis of possibilities for code injection.
  • Detection of man in the middle vulnerabilities.

I am estimating that project like this would take a team of two 4-12 weeks depending on quality. We don't want to bill hourly and are trying to gauge what prices are reasonable per man month?

Generally, for this kind of work what are the ranges for rates and time periods that I should expect to see?

share|improve this question
3  
Why do you want to do it black box? Testers will spend a lot of time (and your money) to understand how the system works. Why don't you want to to do grey/white box PT? Useally it's faster/cheaper + get better results. – AaronS Feb 19 '12 at 6:14
It's actually my company that is getting offered this job, just posted the question in reverse. I think its just easier for them to do black-box as there is less legal / corporate stuff. – nextgenneo Feb 19 '12 at 6:56
Don't expect an answer regarding rates, not least because this can vary wildly depending on location, industry, circumstances, and more. – AviD♦ Feb 21 '12 at 21:50

2 Answers

up vote 2 down vote

Because there are no definites in testing, and especially so in black box testing, I would charge a daily rate, and aim to propose a limit on the number of days based on assumptions. Occasionally we revise the number of days (up or down) if it becomes clear that the assumptions are incorrect (for example if we are provided with no information as to the size of an application we may assume a certain level of complexity which may turn out to be incorrect)

There will be a difference between a pen test only company, which will provide a technical report, and a company which will provide analysis of the technical issues based on your business and information flow.

(disclosure: I have managed teams of >100 in this area for global consultancies - and we have always offered the end to end, business focused testing/assessments. These are most valuable for CIO/FD/CEO level - providing them with a useful report for their money, while providing a technical appendix (similar to the technical report) for deliver to IT.)

share|improve this answer
In principle, I want to agree with you. Unfortunately most companies dont usually want to enter a (potentially expensive) engagement of this sort, without the limits and guarantees of a fixed price. – AviD♦ Feb 21 '12 at 21:47
up vote 0 down vote

I would just pay a flat initial fee, plus an additional fee per exploit / problem found. Depending on the severity of the flaws found, you might also want to pay up a little more for some (this might get rid of any incentive to keep a few for themselves).. Make sure, also, since this is a publically traded company and is dealing with monetary / other sensitive money, I would make sure to have plenty of binding legal contracts =p I would personally go to a professional company (like redspin.com) , because potentially a lot is at stake.

These are just some things I think, they might not be correct. If you want a more definite answer, I would contact a few diffent penetration testing / security companies.

share|improve this answer
1  
I don't know of many security testing companies that expect to be paid per problem. The cost to them is man/hours, so that is generally what they want to be paid for. – Rory Alsop♦ Feb 21 '12 at 18:11
@Ekaj - I think I understand your view. I think you bring a good point, have a clause in the contract, that makes keeping information from the final report very expensive. – Ramhound Feb 21 '12 at 18:24
1  
@Ramhound and Ekaj - no pen test provider will withold info from the report. That isn't what they are contracted to do, and would actually impact them anyway. Sure you want contracts, but focus more on risk and liability. Much more important! – Rory Alsop♦ Feb 21 '12 at 19:21
2  
In addition to @RoryAlsop's point, paying per problem is a bad idea from the customer's perspective too, for several reasons. First of all, you'll wind up paying through the nose for low quality noise. Second of all, a high-quality test cannot be judged by the number of issues reported. Going this route would discourage the testers from going after the harder, more critical bugs, instead of focusing only on the low-hanging fruit. – AviD♦ Feb 21 '12 at 21:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.