this post was submitted on 10 Feb 2024
743 points (99.1% liked)
Technology
59132 readers
3230 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Yes? Pen testing is often “I am hiring you to see how far you can get into the company infrastructure under these constraints.” This includes human interaction, and humans can be a barrier to a pen test.
Part of that is going to be looking as innocuous as possible. Though admittedly that isn’t always the case. This kinda gets blown away when someone goes “oh look, that’s a flipper zero, aren’t those used for hacking?”
Interesting. It sounded kind of ridiculous to me, I guess I didn't consider gaining access to a building or something.
Ah okay, I see the confusion. A lot of people think pen testing is just “try to break into our app” or “try to get into our network” but those are usually narrow scope pen testing.
If you truly want to test your security, you can never rule out physical access. You could have the most secure network in the world and it would mean nothing if you kept it in an unlocked room in a publicly accessible area.
And you’d be surprised by the number of times pen testers gain access to those rooms because of human mistakes.