Topic: Open Source Security Testing Methodology Manual

Message

   How did the project for an Open Source Security Testing Methodology Manual (OSSTMM) start?

																ISECOM began in January 2001 with the OSSTMM. Actually, the OSSTMM
																created ISECOM. The truth is really that I wanted to create a plan on how to
																test security because I didn't think it was being done right and I wanted to
																improve it. So I searched the net only to find everyone referring to this
																proprietary methodology they have that's so great. But I couldn't know because
																I couldn't see it.

																I was suspicious that it was true because I had seen the
																reports of some of the companies that said that they had some great proprietary
																methodology and there was nothing special about what was essentially
																vulnerability scanner outputs re-dressed as reports. So once I finished
																something, I posted it to the web and asked the public to give feedback. I had
																no idea that I was not the only one in need of such a thing. So here we are,
																five years later and the OSSTMM is at around four million downloads since its
																inception - with legislation requiring its use in some countries and some
																government employees and contractors around the world being required to be 
																certified in it just to prove they can really do their jobs. And it's still growing at a fast
																and shiny pace. We're trying to staff-up to handle this all but that's a
																problem in itself.

Author	Message
tanushree Senior Member Joined: 04Apr2007 Online Status: Offline Posts: 2160	Topic: Open Source Security Testing Methodology Manual Posted: 08Oct2007 at 12:19am
	How did the project for an Open Source Security Testing Methodology Manual (OSSTMM) start? ISECOM began in January 2001 with the OSSTMM. Actually, the OSSTMM created ISECOM. The truth is really that I wanted to create a plan on how to test security because I didn't think it was being done right and I wanted to improve it. So I searched the net only to find everyone referring to this proprietary methodology they have that's so great. But I couldn't know because I couldn't see it. I was suspicious that it was true because I had seen the reports of some of the companies that said that they had some great proprietary methodology and there was nothing special about what was essentially vulnerability scanner outputs re-dressed as reports. So once I finished something, I posted it to the web and asked the public to give feedback. I had no idea that I was not the only one in need of such a thing. So here we are, five years later and the OSSTMM is at around four million downloads since its inception - with legislation requiring its use in some countries and some government employees and contractors around the world being required to be certified in it just to prove they can really do their jobs. And it's still growing at a fast and shiny pace. We're trying to staff-up to handle this all but that's a problem in itself. Post Resume: Click here to Upload your Resume & Apply for Jobs

	IP Logged


One Stop Testing Forum : Types Of Software Testing @ OneStopTesting : Security Testing @ OneStopTesting