Open Source Methodologies for Security Testing
I went to a FIST conference the other day in Frankfurt (at the university there). It took from 18:00 to 21:00, a bit more than a dozen people in attendance (incl. Alberto from CISSP-FFM!).
From the invitation: "FIST Conferences are free and open events where to present and talk different aspects of Penetration Testing and Information Security. Presentation of recent conferences in Madrid, Bombay, Delhi, Bangalore, Pune are available here....

• http://groups.yahoo.com/group/PenTest/files/Presentation-Archives/
  
• http://personal.telefonica.terra.es/web/smm/fist.htm"
  

"
The final agenda was

• Introduction - by Frank Sadowski, Cordinator OISSG Frankfurt and Balwant Rathore from OISSG
  
• Information System Security Testing Framework (ISSTF) draft - by Balwant Rathore, CISSP from OISSG
  
• ISSTF Web Application Security Testing Approach by Frank Sadowski

We had good discussions, especially on the risks in penetration testing and the overall need for a good methodology for Web Services testing. - I went away with the feeling that while penetration testing is at times "appealing" to management, from my point of view it has its shortcomings:

• Penetration test findings are often wiped away by the IT dept., with a simple "ok, we'll patch the servers then"
  
• You really test the skills/abilities of the pen testers, not the environment.
  
• Noone can tell whether spending 100,000 USD instead of 20,000 USD has an added benefit.

Interesting enough, there are other (rival?) groups pondering open methodologies for security testing, e.g.

• http://www.osstmm.org, e.g.
  http://isecom.securenetltd.com/osstmm.en.2.9.wireless.pdf,
  see their repository http://www.isecom.org/public_repository.shtml
  
  
• or http://www.owasp.org/ (for web services)

---
http://www.ncjrs.org/
http://virlib.ncjrs.org/lawe.asp?category=48&subcategory=193
Electronic Criime Scene Investigations - Guide for first responders
http://www.ncjrs.org/pdffiles1/nij/187736.pdf
---
WS-I releases Web Services Security Scenarios
http://www.ws-i.org/
http://www.techweb.com/wire/story/TWB20040225S0014
http://www.ws-i.org/Profiles/BasicSecurity/2004-02/SecurityScenarios-0.15-WGD.pdf
  ¶ permanent link