Tagged Questions
-2
votes
0answers
30 views
Summer Security Activities [closed]
I am hobbled up this summer due to a leg injury and will be unable to do the hiking I usually do.
I teach high school and am thinking about setting up a club for the students where they will learn ...
19
votes
7answers
1k views
What should a security audit report include?
Background
I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
6
votes
4answers
465 views
Why is penetration testing important
In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
0
votes
0answers
443 views
Good Android tablet for pentesting apps? [closed]
I'm looking into buying a new Android tablet for pentesting / security auditing apps. Currently I've been using Acer A500 Iconia, but it does not have support for mobile networking which for my ...
5
votes
2answers
165 views
Security Researchers: How do you choose what services or software you are going to audit next?
Security Researchers: How do you choose what services or software you are going to audit next?
I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
4
votes
1answer
129 views
The Economics and White Hat Nature of NSS ExploitHub
This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
4
votes
1answer
387 views
Do blackbox penetration tests make sense if a whitebox audit would be possible as well?
Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
7
votes
1answer
113 views
What should be included in the ground rules for an attack review?
I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics:
Link to the policy that I want to enforce.
Link to a minimal testbed and ...
3
votes
4answers
945 views
Problems during Pen-testing of SCADA systems
Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
