The Ethical Hacker Network

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Network Pen Testing (Moderator: don) > Industry Regs

Pages: [1] Go Down

« previous next »

	Author	Topic: Industry Regs (Read 2614 times)
0 Members and 1 Guest are viewing this topic.

Artful Dodger

Newbie

Offline

Posts: 43

Industry Regs

« on: May 07, 2008, 02:04:29 PM »

Hi everyone,
this should be an easy question, but I cant seem to find a good list. so I figured I would ask my new favorite site!

What industry regulations require Pen Testing? I know the sections in PCI, and I know HIPAA kinda almost suggests it. What other regs state that you must?


	Logged

CISSP, C|HFI, Security+, Network+, XYZ...blah.

Andrew Waite

Hero Member

Offline

Posts: 928

Re: Industry Regs

« Reply #1 on: May 08, 2008, 03:14:57 AM »

From my experience (BS7799/ISO27001 standards) pen testing isn't required for standards but it is the de factor standard for 'proving' your security posture is working. Basically if you don't do pen-testing you better have a good reason for not doing it and be able to explain to the auditors why you feel your systems are secure without standard testing.