Penetration testing / vuln scanning

[john_p]

Do businesses routinely consider this? Thinking both vulnerability of public servers plus the potential exploit of code/web interfaces.

As an administrator at a smaller company, I wouldn't bother using such a service as I trust what *I* can set up.

However, move up the chain a bit and I wonder if managers/legal types might see real value in it.. any opinions..?

[JamieBeeston]

john_p said:

Do businesses routinely consider this? Thinking both vulnerability of public servers plus the potential exploit of code/web interfaces.

As an administrator at a smaller company, I wouldn't bother using such a service as I trust what *I* can set up.

However, move up the chain a bit and I wonder if managers/legal types might see real value in it.. any opinions..?

We sell a few of these.. not enough that it's going to buy me a new Ferrari, but certainly enough to make it a worthwhile service to offer..

Whilst everyone would like to think they're secure as they have set it up themselves, and so it can't be wrong.. you'd be surprised how often a hole IS found..

even as small as the version of the openssl library you dynamically compiled in to you mod_ssl wasn't the one from the latest version you had installed on the box, but a legacy one left over from something previous!

J