2. How can I measure ROI for the SE portion of pen testing?

This one is a great topic. I have a blog post coming to detail this in depth, but will give you the tops of the waves.

#1 The ROI of appliances can not be truly realized without testing the products for effectiveness, responsiveness, proper config, and regular testing/tuning for the environment. The basics....  "how do i know it's thing is providing value if I cant sow you it is working"

#2 The Other way to show the value is to make a bit more of a personal connection. To make relevant the current attacks...  show a sample of where you see these types of attacks (phish, clientside) hitting your network today.  In addition create some VM's to do a demo. If I learned anything from my years of testing is that VIDEO WORKS!  As a side note. Make a claim. "With this type of testing, we will show how to alter/change/delete information in the ""XYZ" system. This system runs our... *make it industry specific.. like  EPHI data, financial data, intellectual property, source code... you get the point*" Then explain to them that a compromise within those systems will put you in violation of compliance * use what applies... If there is no compliance... make it relevant to the business. XYZ system controls our $$ or how we make $$.  If it gets hacked...  we lose.

The whitepaper is a bit more eloquent... but u get the point.

=o)

Q: On a PenTest team, what is the best way to collaborate what you have found? I pentest and I have found that communication break down is one of the biggest problems within the PT team social context.

In person is #1. Grab the team, put em in a room and  go at it.

#2  make sure you have a distinct process. It allows engineers to freestyle but keeps everyone on the same page.

#3 P0wned list. Mae a secured Wiki, have a shared doc..  or use collaboration frameworks to take notes for juicy intel and info. Review this list with the whole team daily for large projects and  every half day for smaller gigs.

#4 Leverage traditional PM skills

#5 Create incentive. You get x bonus if you find unique info.. . You lose y points/bonus if you dupe info.

 i have more  if ya really need help. I have ran roughly 30 security consulting shops and managed 10-50 engineers at a time

Thanks so much for a great presentation and thanks for answering all of the questions.   I hope EH does more of these.

More SE or just more webcasts in general?

Don

I second that, more of both, SE and Webcasts. 

I had to leave the webinar half-way through.
but my interest was peaked.
I would very much like to see the rest of the presentation.
Will the recorded session be made available for EH.NET users ?

I sure hope so 

Look for video soon!

Don