Re: Does anybody here have any experience with penetration testing services?

I have a customer who works with one. They were told they HAD to because a
3rd party company who handles all their CC functions has a link to their
web page. They do not ever transfer any sensitive info between the sites.
But, they were convinced (not the IT guy or me) that they must be compliant
as well.

Now, I've seen the reports and they are crazy weird. They will look for
ANYTHING to ping you with a fee for being "non-compliant". Wrong HTTP
headers (which mean literally nothing to an attacker), a port open but not
responding... even ports that should be open (like 443) and if you have
anything in place to stop DoS, etc attacks which even stops their ability
to probe, you will get pinged.

Just be forewarned. :) Ask for a free trial for a month with unlimited
tests so you can meet their "criteria"... because they all seem to be
different, and they change daily.


On Fri, Feb 10, 2023 at 4:31 PM James H. H. Lampert via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

The subject line pretty much says it all: I've been asked to look into
penetration testing services, and in particular to assess their
robustness, trustworthiness, and cost-effectiveness. And I haven't a
clue where to find out about their trustworthiness and robustness.

--
JHHL
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.