New Pentesting TV Show Coming Out

I’m an IT professional and see no security value in publicly exposing weaknesses in the world’s most sophisticated security systems. This is not defeating criminals at their own game. It used to be that one had to go to prison to be trained in crime. Just another tactic of spreading fear. There is no such thing as a foolproof cost effective security system. Fix this by enforcing and the law. If I want less hot water I simply turn a knob on my sink.

Jason,

The point here is pretty simple: if we don’t check ourselves to see if we have weaknesses, someone else will. We should not simply wait to be attacked using various methods that we’re too lazy to find ourselves.

Penetration testing is an excellent way to test mature security programs. It doesn’t prove security, but if it uncovers something, that information is often invaluable.

I’ve done security audits. To get my point watch “Bowling for Columbine.” Watch how the fear Americans feel due to what is programmed on TV for us is juxtaposed against Canadians viewpoint on fear.

On a side note, I believe hackers who expose security holes publicly are wrong. Such exposures does not allow a vendor time to fix the problem before the exposed hack is likely used by the now informed public. The way I see it, the only right way to expose discovered security holes is to inform the vendor, period. Any further actions are only born from a desire for recognition. A fact for which IT vendors could capitalize.

On the disclosure point, that’s generally accepted to be true. The only question is how long to give the vendor before going public.