An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Enjoy!
Not likely, remember security is a process not a product. That is why things like SOC and iso 27000/27001 exist to show as a company you have processes in place to protect their own data and customer date
company survived a 5-day pentest
While I like the thought, I would think threat actors would take that as a challenge.
I agree with security being a process.
However, in my experience something like an ISO 27001 checks just documents. Except for spending a lot of money and time into creating and maintaining these, the label does not tell me anything about if the company is able to handle real-world incidents. At least if the auditor is not very into tech (which I cannot know just looking at the resulting label).
But +1 for
I would think threat actors would take that as a challenge.
:D
I don’t have the document on hand while writing this, but I believe ISO27001 and most other certs have controls around regular pentests on an organization’s infrastructure and applications, and they ask for evidence that those are done regularly and ask for proof of remediation of findings during audits. While they don’t directly ask if “company survived a 5 day red team exercise”, the control processes they check for indirectly checks for those. And yes, it largely depends on how technical and how deep the auditor wants to go.
Not likely, remember security is a process not a product. That is why things like SOC and iso 27000/27001 exist to show as a company you have processes in place to protect their own data and customer date
company survived a 5-day pentest
While I like the thought, I would think threat actors would take that as a challenge.
I don’t think any major company I know of could get through a pen test without the hackers getting through.