Solved

What should we pay for Vulnerabilty Testing???

Posted on 2007-11-27
3
297 Views
Last Modified: 2010-05-18
Hello we are a small financial institution and are in need of basic vulnerability testing (NOT INTRUSION or external) just Vulnerability testing from the inside. We have to have this, so please don't try to tell what other options I have. We are getting a wide range of prices and services and I am not sure what we should be paying for this. We have 25 TOTAL nodes, and have been quoted from 100-200/per node plus software usage fees. Flat fees from $3500-7500. Hourly fees etc etc.
Can anyone clarify this for us? We are Windows XP running Server 2003 with 3 locations.
Thank you
0
Comment
Question by:final4fever
  • 2
3 Comments
 
LVL 18

Accepted Solution

by:
PowerIT earned 200 total points
ID: 20364183
This is probably more of an economics question then a security question, but I'll still try to formulate an answer.
First, you should not pay more then it's worth to you. But also not much less, or quality will suffer.
I have the feeling that you are legally obliged to do this, so it will be hard to set a maximum value, because if you don't then you are probably out of business.
So then the price will also be influenced by current market demand. You know, supply and demand.
IF I do a quick calculation using avarage tarifs I know about and needed time then I would say: $4.375 + travelling costs for the 3 locations.
Mind you: this is an avarage. Where you are located can also vary the pricing: in some area's consultancy (and the labour hours) is more expensive then in others. Hiring in London or NYC will be more expensive then lets say ... Kiev.

Hope this helps.

J.

0
 
LVL 7

Expert Comment

by:nttranbao
ID: 20364355
You may want to use nessus ( www.nessus.org) to scan the system yourself, and see the explanation for each vulnerability found.
0
 
LVL 18

Expert Comment

by:PowerIT
ID: 20364401
I doubt that doing a vulnerability assessment by a non (certified) security professional who can not accurately interpret the results will be sufficient as a required audit for a financial institution.

J.
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
mysql disables rename 4 76
Securing Azure Oracle instance of Linux VM 4 59
Local User Account Group Policy 8 43
exchange, activesync 2 12
Examines three attack vectors, specifically, the different types of malware used in malicious attacks, web application attacks, and finally, network based attacks.  Concludes by examining the means of securing and protecting critical systems and inf…
In this increasingly digital world, security hacks are no longer just a threat, but a reality. As we've witnessed with Target's big identity hack 2013, Heartbleed in 2015, and now Cloudbleed, companies and their leaders need to prepare for the unthi…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question