A CISO's Best Friend: The Pentester
summary
Argues that pen tests become a long‑term capability, not a checkbox: use twice‑daily checkpoints, forward EDR alerts immediately, run BloodHound collectors and share the maps, plant in‑environment flags/CTFs to validate lateral movement, and give a two‑week report review with concrete retest commands. Gives concrete mistakes — default creds on SIMs, exposed iLO, FTP in clear text, risky use of EternalBlue — and cites the adversary’s median dwell of 277 days as urgency to iterate over years.
AI-written summary · about
chapters (6)
- 0:00Start
- 8:07Blue Responsibilities - continued
- 26:03Alternative-Systems are secure
- 27:26Alternative-Access is denied!
- 28:50Alternative-Minimal scoping as a control
- 31:58Alternative - The Threat Treatment
related talks
12mConfessions of a reformed pentester
52mContinuous Security
28mBeyond Penetration Testing: Developing a Defensive Cyber-Workforce
32mPicking the Low-Hanging Fruit – Easy Pentest Wins
23mHack Your Cybersecurity Career: Your Role in the Ecosystem
19mPenetration Testing
44mApplication Security: Everything we know is wrong
34mBeating the pentester