Engaging a team for a security analysis

Being involved in a security project requires lot of resources: a good measure of knowledge, a huge measure of experience, some amount of software and personnel. Usually time is in short supply, so this is compensated by more computers or more people.


  • The first option is to use a computer and a piece of software. While there are a lot of automated tools that a security consultant can use, these are not really smart.
    • For penetration tests - most vulnerability scanning systems are 'loud' as hell and will be immediately detected by any IPS/IDS system. Also, such systems are very rarely successful at any penetration unless properly tweaked and configured by a human operator.
    • For procedural assessment, that software is just a set of questions forming a checklist. The problem is that every organization has specifics in their security organization, and the actual procedural posture of security needs to be understood by an expert operator in order to properly answer the questions in a checklist.

  • The second option is to hire a freelancer team. Presently, there are a very large number of people looking for a freelance gig as security analysts. Some of them publish their expertise through social networking sites, others just use job search sites to look for an engagement. But this is a nightmare in itself for at least two reasons:
    • Unknown amount of expertise - when hiring someone for a security job, unless you know his/her previous work it is very difficult to know whether he/she will deliver the expertise. Please note that the CV of a person can say anything without much means of confirmation - references for previous security engagements are very rarely given by clients.
    • Unknown agenda - even if he/she is a great expert, you will open the doors of a corporation to that person. Unless you are 100% certain of his/her professional agenda, you may find yourself in a lot of legal trouble if there is a disclosure of confidentiality or even malicious attack from someone in your freelancer team.

As Alan Weiss points out, you should only get into partnerships if you can multiply the profit by a hundred, not double it. And in cases of security analysis, you can easily deplete your profit with a choice of a wrong team, let alone be stuck with some legal issues.

Talkback and comments are most welcome

Related posts
Tutorial - Secure Web Based Job Application
8 Steps to Better Securing Your Job Application

13 comments:

Anonymous said...

A trivial and uniformative post, I wonder why you bothered.

soniboni said...

good which was recently called as PlayBox HD app. open this site If you prefer to download and install Theatre Field App on your smartphone, Download Cinema Box for PC great.

Deepweb Links said...

nice post
deepweb links
onion links
deepweb sites
onion sites

ershovayuli said...

good The software user interface is definitely basic and extremely open Mobdro for home windows 8, 8.1, 10, 7 and on Mac Operating-system Mobdro Download PC nice.

robertgreene said...

good and commence it applying it right away and properly: open Download the record to your mobile phone right aside, Prisma Download PC nice.

Mark Collins said...

IMO Download For Mobile
All Mortal Kombat Characters
How To Play Clash Of Clans On PC
SHAREit APK

DanielsLindsay said...

good Vidmate for android can be obtainable for no cost of expense. Vidmate for Windows visible consequently various amount of folks happen to be good.

Getit said...

Lovely blog it is. Download Zapya for PC to share files and folders easily from PC to Mobile

http;//deepweblinkss.com said...

good and useful post...
deep web links

audreybphillips said...

good mimic the pinch function to zoom in as well as out. Download 9Apps APK Most recent information- In January, 9Apps launched nice.

Sunmugam Chidambaram said...

I Pleased to Read Nicele
Download xender for pc
Very good for share FILES ,PICTURES PC To any Android

cathrynzbrown said...

good its membranes and main filters in the US. Northstar Water Softener Reviews that we reviewed, the RCC 7, has 3 filter best.

Roshaan Asghar said...

ENGAGING A TEAM FOR SECURITY IS A GOOD WAY TO PROTECT YOURSELF. Showbox

Designed by Posicionamiento Web