diff --git a/_drafts/2032-10-20-example-post.md b/_drafts/2032-10-20-example-post.md index 3c9a8753..c2737dc7 100644 --- a/_drafts/2032-10-20-example-post.md +++ b/_drafts/2032-10-20-example-post.md @@ -19,10 +19,10 @@ category: updates image: # Images are stored in the assets/img/ folder. # Create a new subfolder within assets/img/blog/ for each post new. - hero: blog/10/hero.jpg + hero: blog/1/header.jpg # Upload a 1920x1008 image, replace 10 with the post slug or number # This is used for the background on the post - feature: blog/10/feature.jpg + feature: blog/1/feature.jpg # Upload a 1200x630px image, replace 10 with the post slug or number # This is used for the preview of the post credit: cottonbro studio diff --git a/_posts/2024-02-10-ptaas-is-bs.md b/_posts/2024-02-10-ptaas-is-bs.md new file mode 100644 index 00000000..a257ca00 --- /dev/null +++ b/_posts/2024-02-10-ptaas-is-bs.md @@ -0,0 +1,80 @@ +--- +layout: post +# The filename will be used for URL slug generation, try to keep it to 1-3 words +title: "PTaaS is BS" +# Keep the title short, does not need to match the filename +subtitle: "Why (we think) Penetration Testing as a Service is bullshit." +# Subtitles should be 90-120 characters +date: 2024-02-10 +# Date in YYYY-MM-DD Format, should match date used in the filename +date-updated: +# Date in YYYY-MM-DD Format. Add this if a change is made after the date above +author: Jade Null +# Use "GlitchSecure" if no author +coauthor: +# Coauthor or optionally the editors name +category: updates +# Use either updates, resources, guides as the category + +image: +# Images are stored in the assets/img/ folder. +# Create a new subfolder within assets/img/blog/ for each post new. + hero: blog/10/header.jpg + # Upload a 1920x1008 image, replace 10 with the post slug or number + # This is used for the background on the post + feature: blog/10/feature.jpg + # Upload a 1200x630px image, replace 10 with the post slug or number + # This is used for the preview of the post + credit: Vladimir Srajber + # Include the feature photo authors name + creditlink: https://www.pexels.com/photo/horse-poop-on-ground-15671402/ + # Include link to original photo source +hero-vertical: true +# Whether to use a vertical layout. Default is true for blog posts. +hero-wrapper-padding: "pb-24" +# This must be set to "pb-24" when using a vertical layout and removed when not. +comments: true +# Whether or not comments are enabled. This hasn't been implemented yet, but generally we can leave them enabled for anything that's not an update. +--- + +Recently a redditor asked ["What the hell is PTaaS?"](https://old.reddit.com/r/cybersecurity/comments/1acpbmi/what_the_hell_is_ptaas/) + +This is a really good question. While every vendor has a different spin on what they call Penetraion Testing as a Service, the term is often assoiated with one or both of the following: + +- Providing Penetration Testing services in a more real-time manner utilising a custom built dashboard or off the shelf software like Plextrac instead of forcing you to wait for some consultant to craft a PDF in word. +- Using crowd-sourced gig-workers to more quickly spin up a penetration test at a lower cost. + +In this article, we'll dive into why we think the PTaaS model is marketing bullshit, and why we actively avoid using it. + +# Traditional Penetration Testing + +Before we dive into PTaaS, it's important to look at how Penetration Testing has historically been performed. + +Usually the process looks a little something like: + +1. Find a reputable security consultancy and work with them to scope out a test +2. Get a quote and set a time on the calendar for the test to begin +3. Anxiously wait for the testing period to come and go, get a fancy PDF report some time later +4. ~Argue~ work with the consultants to ensure your patches actually fix the flaws. + +This process often involved a lot of spreadsheets, emails, and meetings. While some consultancies figured this out better than others, it's a process just dieing for a software solution. + +# -aaS All The Things + +Efforts to streamline parts of the traditional penetration testing process with a software platform have always been a thing. But where there is software, there are people looking to turn that into a subscription. + +# Uber for Pentesting + +One of the most infamous users of the term, the ~dingleberries~* lovely folks at Cobalt, [once described PTaaS](https://resource.cobalt.io/hubfs/Pentest_as_a_Service_Impact_Report_2020.pdf) as the following: + +> We define Pentest as a Service (PtaaS) as a service that utilizes a global talent pool of certified +pentesters and a data-centric platform to deliver pentests. + +* Cobalt once spent 6 months trying to bully GlitchSecure and a friend of the company with legal threats, but that's a story for another time! Don't waste everyones time again Chris ;) + +Building on the backs of commerical and open source penetration testing platforms alike, + + +# It's all BS + +# Other Options diff --git a/assets/img/blog/10/feature.jpg b/assets/img/blog/10/feature.jpg index a7376046..57940d3b 100644 Binary files a/assets/img/blog/10/feature.jpg and b/assets/img/blog/10/feature.jpg differ diff --git a/assets/img/blog/10/header.jpg b/assets/img/blog/10/header.jpg index a7376046..5a055c18 100644 Binary files a/assets/img/blog/10/header.jpg and b/assets/img/blog/10/header.jpg differ