The simulated security assessment ecosystem: Does penetration testing need standardisation?. Issue 62 (September 2016)

• Record Type: Journal Article
• Authors: Knowles, William; Baron, Alistair; McGarr, Tim
• Is Part Of: Computers & security. Issue 62(2016)
• Page Start: 296
• Page End: 316
• Publication Date: 2016-09
• Subjects: Penetration testing -- Security -- Evaluation -- Standards -- Assessment; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2016.08.002
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Simulated security assessments (a collective term used here for penetration testing, vulnerability assessment, and related nomenclature) may need standardisation, but not in the commonly assumed manner of practical assessment methodologies. Instead, this study highlights market failures within the providing industry at the beginning and ending of engagements, which has left clients receiving ambiguous and inconsistent services. It is here, at the prior and subsequent phases of practical assessments, that standardisation may serve the continuing professionalisation of the industry, and provide benefits not only to clients but also to the practitioners involved in the provision of these services. These findings are based on the results of 54 stakeholder interviews with providers of services, clients, and coordinating bodies within the industry. The paper culminates with a framework for future advancement of the ecosystem, which includes three recommendations for standardisation.