Testing with open eyes

摘要

Iregularly meet with would-be clients to discuss their upcoming security consulting requirements, and with increasing regularity I am finding that they have never had their network infrastructure or business-critical systems assessed by an outside agency. A starting point for many of these discussions begins with, "can you do penetration tests, and can you do it 'blind'?" This is an interesting question, and a clear indicator that the potential client has either watched too many hacking movies or browsed through one of the mainstream how-to-hack books.