We are reviewing our organization's information security posture, and we have a few questions that we would like to pose to the group:
1) What activities does your organization engage in for the areas of penetration testing and/or ethical hacking?
2) Which of these activities do you consider valuable (and would recommend), and what key risks are associated with implementing them?
3) Are there other activities in these areas that you hope to implement in the future?
We appreciate any feedback (if your feedback is too sensitive for posting, we'd be happy to email or setup a call, etc.).
@EdSkinner1 Try this consolidated link via OWASP and OSSTMM, NIST-800-115 etc:
This should give you a good grounding and a baseline to determine what you want from Ethical Penetration Testing services and for contractual purposes and measurement.
My former employer did a lot of research on and use of phishing attacks. My core advice on using phishing attacks as part of your EH set is to make sure it is set up as a training experience for the employees, and not a gotcha jump on them.
Also, make darn sure you pay special attention to targeting your whales.