Penetration Tester and Vulnerability Researcher, with 5 years’ experience in information security. Responsible for the detection of several dozen 0day vulnerabilities. Mainly focused around Web technologies and exploitation of high-severity issues.

Penetration Testing Management – Problems in Large Corporations

Penetration Testing is an authorized, systematic, and in-depth evaluation process of testing a computer system, network or web application to find security vulnerabilities that an attacker could exploit. Large corporations and companies tend to organize their own, internal Penetration Testing teams in order to properly assess their environment. However, Penetration Tests management in such organizations is burdened with multiple problems, like:
• Scoping problems.
• Divergent goals across different teams.
• Retest management.
• Vulnerability tracking
The goal of this presentation is to share authors’ experience and view on the Penetration Testing management in large organizations. Multiple problems are highlighted in the presentation, together with a possible directions towards their solving. It may provide an useful insight to not only those, who are organizing internal Penetration Testing teams, but also to people of other positions.

This presentation is co-presented with Marek Zmysłowski, Penetration Testing Lead @ Standard Chartered Bank.