I work for a major publicly traded company and we need some external black box pen testing done on a Win32 executable. This exe is used in a large client server infrastructure and is a central piece of our core business. It handles monetary transactions so it is vital that it is secure. The scope of work we would want audited are:
- Protocol reversal of client / server communication.
- General binary analysis for potential vulnerabilities.
- Analysis of possibilities for code injection.
- Detection of man in the middle vulnerabilities.
I am estimating that project like this would take a team of two 4-12 weeks depending on quality. We don't want to bill hourly and are trying to gauge what prices are reasonable per man month?
Generally, for this kind of work what are the ranges for rates and time periods that I should expect to see?