Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -4 down vote favorite

As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues?

LE: So most of you guys downgrade, and said it's wrong to have this kind of platform. Instead Google, Facebook, PayPal and other big companies have a Bug Bounty Program which it works very well. Who's wrong? Them or... ?

share|improve this question
3  
OP apprently belongs to [spam], see blog.[spam] There are other sites that follow the same principle, see hatforce.com for example. (Mod Edit: Removed url to advertised site) – twobeers Jul 25 '12 at 13:48
Yes of course, I asked to see if we are helping people like you or not. Why would I hide? – Marius Corîci Jul 25 '12 at 13:50
1  
@MariusCorîci, per the FAQ, if you are affiliated with the product, you are expected to disclose your affiliation in the question. – D.W. Jul 25 '12 at 19:02
1  
I suspect this question is too narrowly scoped and too localized to be a good fit this site. I would not encourage questions about a single product, particularly when that product is not widely used and when the question will only be relevant to a tiny number of people around the world. – D.W. Jul 25 '12 at 19:04

4 Answers

up vote 1 down vote

I can't see this being acceptable for any of my clients- their risk management rules would prohibit this sort of thing.

You would need to get vetting for every tester, individual NDA's, signoff and approval to avoid falling foul of the computer misuse act etc.

How will the client validate the testing methodology?

Most of all, they require a provider with a rock solid reputation and decent liability coverage.

share|improve this answer
up vote 0 down vote

I think this is not the best idea because the process is not knows nor documented, such hackery by anonymous parties I have every day, and I have hordes of them, and I cant believe somebody wants even more money to pay to actually get hacked. I got 100 page report every day from all sorts of hacks.

The trick is if I send you my vm image, if you can make it secure and send me it back, you can't make it, because you would require a specific product, and you dont have a product, procedure or anything like this and offer only "hackery", which is very easy to do, obviously you can hack into any LAMP and Windows server and this is nothing really revealing only except how much damage you can really make. So you could say simply: "you are not having enough security to not be crowd hacked".

It would be much better, if you would actually utilize some sort of process like SDL, which would include securing the application, so for this I could spend £100 per month per vm image, and it would have to be bullet-proof including auto-learning and updates, and the test environment for hacking and security tests, with sync from my SVN, and that would include 3rd party patch review and DDoS testing, mailbox abuse, brute-force, the performance report and load tests stats and it would include Network, System and Application, plus the DNS, LDAP and Mail and whatever specific there is.

I dont know any website doing anything like this with these methods, but "these" methods fit in SDL at the two or three last stages, so in order to professionally utilize it that would require all stages, documented, and implemented, which would be a very complex problem, maybe standard LAMP and Windows would be OK to start with.

It fits also with government - you might get a mission which includes hacking into national power and nuclear infrastructure, this way you could test definitely the NHS, but not banks, and definitely you should try with army. If you can make it, you can make it make sense, because for business this is not the most useful thing, because businesses can make this themselves which is more secure, and legally enforced.

share|improve this answer
"such test won't deliver any useful things". Why do you think so? – Andrey Botalov Jul 25 '12 at 18:36
To: Andrew Smith It's not because I'm involved but imho would be better first to investigate what is all about, as a registered user (no worries, after you take a look just delete your account), read the blog, and try it. That would be helpful for you as much for me. – Marius Corîci Jul 25 '12 at 18:45
up vote 3 down vote

As far as I can tell from the description on the websites, you can't really tell who tests your application/server and how good they are at finding vulnerabilities. So you can't rely on a statement like "No vulnerabilities found." I would rather use a company with a good reputation. A free test that doesn't find any vulnerabilities really doesn't help. It might even be bad for you by providing you with a false sense of security.

share|improve this answer
Thx for your answer. The idea is you don't have to pay for anything but only vulnerabilities that you consider they deserve your attention. For instance you can choose what to be tested for like Critical, Major Medium or Info. If your system is safe, you don't have to pay. – Marius Corîci Jul 25 '12 at 15:14
up vote 5 down vote

Absolutely not, it may be a great idea in some ways but if I'm going to get a penetration test it is from a company that signs a contract that includes a non-disclosure agreement, otherwise I have no legal recourse if things go wrong. Using this would just paint a big "hack me, I think I may be insecure" on my sites.

share|improve this answer
Greg you're right until one point. There are companies that require such penetration test (e.g. gov. financial etc) and the others that doesn't require but they develop web apps or SaaS servicies. For those who does not require authorized penetration tests this platform is it for. Moreover, startups have two big issues: Scalability ant Security and here, instead to hire pentest specialist, they simply can use this service. – Marius Corîci Jul 25 '12 at 15:18
2  
Marius I can see that you really believe in this idea, and I'm sure it will get some uptake amongst startups and small operators. However, your question was "As a CIO, CISO, CTO or Sys Admin, would you use this service in order to improve your security issues?" My answer is no, I would not for the reasons stated above. – GdD Jul 25 '12 at 15:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.