1

Lets say I hire a person for "Ethical Hacking and Penetration Testing". He will try break the security of my system/web site.

Lets say then the hired person is not successful in the invade the system.

Obviously, I'm not a security expert, so how I can tell if:

  1. My system is very safe! The "security expert" cannot invade it!
  2. The "security expert" is not good enough to invade it...
Improve this question
1
  • 3
    Could be either. Could also be 3. They didn't have enough time to test every part of the system. Don't forget that an attacker isn't time limited. They can work on breaking into your system for months. Any pen test will be time limited.
    – Matthew
    Dec 17, 2016 at 19:21

1 Answer 1

Reset to default
1

When you hire a security consultant / penetration tester to perform an evaluation of your security posture for a Security Best Practices assessment, you should be receiving a report at the end of the penetration test. This is a large part of the job. As well, there are automated scanners that you can use against your network or web application which will give you a higher-level overview on the overall posture of the network.

When you receive the report from the tester, it is generally going to contain an Executive Summary, which is meant to provide an overall debrief regarding the posture of your security without going too deep into technical details.

Often times, and for numerous vulnerabilities, the tester will be able to confirm the presence of the vulnerability though it may not be a vulnerability that allows for them to gain remote code execution. RCE (or "getting in") is only one part of a large array of vulnerability exploitation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .