BSides Atlanta 2020

Pen Tests. We all do them. The regulators require them. The board wants to see them. They are taking more time, more resources, and more effort. So how do we move from just ticking a box and saving a report, to a test that creates value and moves the needle on security and your security program as a whole? This talk starts from the basic premise that you are doing a test, and walks through from inception, planning, execution, followup and remediation to lay out the pitfalls and traps that are waiting, and how to avoid them. 

Additional content for reviewers (omit from abstract online and in print) 

This talk has been given to FS-ISAC conferences and has been well received. In the talk I go through what pen testing is, what pen testing is not, how to get a good pen test, what to put in contracts, rules of engagement, how to work with pen testers, and how to manage results from a pen test to get successful remediation.

https://zoom.us/j/998173381