diff --git a/xml/source/snippets/offerte/en/aboutus.xml b/xml/source/snippets/offerte/en/aboutus.xml index 6b079d1..ba43c1c 100644 --- a/xml/source/snippets/offerte/en/aboutus.xml +++ b/xml/source/snippets/offerte/en/aboutus.xml @@ -1,42 +1,69 @@
- About <company_long/> -

is the world's first not-for-profit computer security consultancy. - We operate under an innovative new business model whereby we use a Dutch fiscal - entity, called a “Fiscaal Fondswervende Instelling” (Fiscal Fund raising Institution), - as a commercial front-end to send 90% of our profits, tax-free, to a not-for-profit - foundation, Stichting NL net. The NLnet Foundation has supported open-source, - digital rights, and Internet research for almost 20 years.

+ About + <company_long/> + +

+ + is the world's first not-for-profit computer security consultancy. We + operate under an innovative new business model whereby we use a Dutch fiscal + entity, called a “Fiscaal Fondswervende Instelling” (Fiscal Fund raising + Institution), as a commercial front-end to send 90% of our profits, + tax-free, to a not-for-profit foundation, Stichting NL net. The NLnet + Foundation has supported open-source, digital rights, and Internet research + for almost 20 years. +

-

In contrast to other organizations, our profits do not benefit shareholders, - investors, or founders. Our profits benefit society. As an - organization without a profit-motive, we recruit top-name, ethical security - experts and find like-minded customers that want to use their IT security - budget as a "vote" to support socially responsible entrepreneurship. The rapid - pace of our current growth reflects the positive response the market has to our - idealistic philosophy and innovative business model.

+

In contrast to other organizations, our profits do not benefit + shareholders, investors, or founders. Our profits benefit society. As an + organization without a profit-motive, we recruit top-name, ethical security + experts and find like-minded customers that want to use their IT security + budget as a "vote" to support socially responsible entrepreneurship. The + rapid pace of our current growth reflects the positive response the market + has to our idealistic philosophy and innovative business model. +

-

has a number of values that we describe as our - “Core Principles.” These are:

- -

For more information about , we refer you to our website: -www.radicallyopensecurity.com.

+

+ + has a number of values that we describe as our “Core Principles.” These are: +

+ +

For more information about, we refer you to our website: + + www.radicallyopensecurity.com. +

diff --git a/xml/source/snippets/offerte/en/additional-code-audit_methodology.xml b/xml/source/snippets/offerte/en/additional-code-audit_methodology.xml index 63f1329..12d6d97 100644 --- a/xml/source/snippets/offerte/en/additional-code-audit_methodology.xml +++ b/xml/source/snippets/offerte/en/additional-code-audit_methodology.xml @@ -2,48 +2,53 @@
Code Audit

- will perform a code audit to aid pentesting. During a - code audit, we manually examine the code of an application to ensure there - are no security vulnerabilities and use our understanding of the code to - guide our pentesting. If vulnerabilities are found, we document those and - suggest ways to fix them. This is done by highly-trained penetration testers - who can both review the raw code as well as interpret the findings of the - automated scans, putting them into context. + + will perform a code audit to aid pentesting. During a code audit, we + manually examine the code of an application to ensure there are no security + vulnerabilities and use our understanding of the code to guide our + pentesting. If vulnerabilities are found, we document those and suggest ways + to fix them. This is done by highly-trained penetration testers who can both + review the raw code as well as interpret the findings of the automated + scans, putting them into context.

- During the code audit portion of penetration tests, we take the following - criteria into account: + During the code audit portion of penetration tests, we take the following + criteria into account:

    -
  1. Risk Assessment and "Threat Modeling"
    - In this step, we analyze the risks of a particular application or system. - Threat Modeling is a specific, structured approach to risk analysis that - enables us to identify, qualify, and address the security risks, thus - dovetailing with the Code Review process. For example, user data is - sacred. We focus on encrypted storage, discover if employees - have a backdoor into data, and cut loose stolen devices by wiping them - remotely and revoking accounts. +
  2. Risk Assessment and "Threat Modeling" +
    + In this step, we analyze the risks of a particular application or system. + Threat Modeling is a specific, structured approach to risk analysis that + enables us to identify, qualify, and address the security risks, thus + dovetailing with the Code Review process. For example, user data is + sacred. We focus on encrypted storage, discover if + employees have a backdoor into data, and cut loose stolen devices by + wiping them remotely and revoking accounts.
    3. -
  3. Purpose and Context
    - Here we focus on risks, especially in the quick and easy sharing of - internal documents and itineraries. Account details aren't so secret - when we know who will be in meetings, but what's being discussed is secret. +
  4. Purpose and Context +
    + Here we focus on risks, especially in the quick and easy sharing of + internal documents and itineraries. Account details aren't so secret when + we know who will be in meetings, but what's being discussed is secret.
    5. -
  5. Complexity
    - The complexity of the system is in the frameworks that support the web - application. We'd ignore those and focus only on the custom code and - backend code. We would also - focus on implementation mistakes and known flaws in the systems. For - example, we'd ensure you're using the latest versions of software, - but we wouldn't delve into the framework itself. Since we assume the - code is written by a team, it should be clearly-written code. If you have - several full-release versions, there will undoubtedly be several revisions - and audits on that code. +
  6. Complexity +
    + The complexity of the system is in the frameworks that support the web + application. We'd ignore those and focus only on the custom code and + backend code. We would also focus on implementation mistakes and known + flaws in the systems. For example, we'd ensure you're using the latest + versions of software, but we wouldn't delve into the framework itself. + Since we assume the code is written by a team, it should be + clearly-written code. If you have several full-release versions, there + will undoubtedly be several revisions and audits on that code.

- For more information, please refer to this link: - - https://www.owasp.org/index.php/OWASP_Code_Review_V2_Table_of_Contents + For more information, please refer to this link: + + https://www.owasp.org/index.php/OWASP_Code_Review_V2_Table_of_Contents +

diff --git a/xml/source/snippets/offerte/en/black-box.xml b/xml/source/snippets/offerte/en/black-box.xml index 30c239a..cfb641a 100644 --- a/xml/source/snippets/offerte/en/black-box.xml +++ b/xml/source/snippets/offerte/en/black-box.xml @@ -1,16 +1,14 @@
-The Black-Box Pentesting Method -

- Crystal-Box vs. Black-Box pentesting refers to the amount of information - about the target environment, architecture, and/or applications that the customer - initially shares with the pentesters. With Black-Box testing, pentesters - are given no information whatsoever about the target(s). With Crystal-Box testing, - pentesters are given all information requested about the target(s), including - source code (when relevant), access to developers or system management, etc.. -
-
- In this case will conduct a black-Box test. -

+ The Black-Box Pentesting Method +

+ Crystal-Box vs. Black-Box pentesting refers to the amount of information + about the target environment, architecture, and/or applications that the + customer initially shares with the pentesters. With Black-Box testing, + pentesters are given no information whatsoever about the target(s). With + Crystal-Box testing, pentesters are given all information requested about + the target(s), including source code (when relevant), access to developers + or system management, etc. +

+

In this case will conduct a black-Box test.

- \ No newline at end of file diff --git a/xml/source/snippets/offerte/en/conditions.xml b/xml/source/snippets/offerte/en/conditions.xml index f09b2dd..00e93c3 100644 --- a/xml/source/snippets/offerte/en/conditions.xml +++ b/xml/source/snippets/offerte/en/conditions.xml @@ -1,21 +1,32 @@
- Terms and Conditions -

will only perform the - if it has obtained the permission from - as set out in the penetration testing waiver, attached as Annex 2, - or provided in a separate document.

- -

performs this assignment on the basis of its general - terms and conditions, which are attached to this offer as Annex 1. - rejects any general terms and conditions used by - .

-

In order to agree to this offer, please sign this letter in duplicate - and return it to:

- - -

Overdiemerweg 28
1111 PP Diemen
+ Terms and Conditions +

+ will only perform the + if it has obtained the permission from + as set out in the penetration testing waiver, + attached as Annex 2, or provided in a separate document. +

+ +

+ + performs this assignment on the basis of its general terms and conditions, + which are attached to this offer as Annex 1. + rejects any general terms and conditions used by + . +

+

In order to agree to this offer, please sign this letter in duplicate and + return it to: +

+ + + + +
+ +
Overdiemerweg 28
1111 PP Diemen +
melanie@radicallyopensecurity.com - - -
\ No newline at end of file + + + \ No newline at end of file diff --git a/xml/source/snippets/offerte/en/crystal-box.xml b/xml/source/snippets/offerte/en/crystal-box.xml index b468c51..6bccbd4 100644 --- a/xml/source/snippets/offerte/en/crystal-box.xml +++ b/xml/source/snippets/offerte/en/crystal-box.xml @@ -1,4 +1,4 @@ - +
The Crystal-Box Pentesting Method

@@ -20,4 +20,4 @@ crystal-box pentesting fits naturally hand-in-hand with the "Peek Over Our Shoulder" option that offers to .

-
+ diff --git a/xml/source/snippets/offerte/en/disclaimer.xml b/xml/source/snippets/offerte/en/disclaimer.xml index 0215784..6297971 100644 --- a/xml/source/snippets/offerte/en/disclaimer.xml +++ b/xml/source/snippets/offerte/en/disclaimer.xml @@ -7,7 +7,6 @@ , instead, has an obligation to make reasonable efforts (in Dutch: “inspanningsverplichting”) to perform the agreed services.

-

and agree to take reasonable measures to maintain the confidentiality of diff --git a/xml/source/snippets/offerte/en/disclaimer_code-audit.xml b/xml/source/snippets/offerte/en/disclaimer_code-audit.xml index 8168427..a274bb5 100644 --- a/xml/source/snippets/offerte/en/disclaimer_code-audit.xml +++ b/xml/source/snippets/offerte/en/disclaimer_code-audit.xml @@ -8,11 +8,8 @@ , instead, has an obligation to make reasonable efforts (in Dutch: “inspanningsverplichting”) to perform the agreed services.

-

- - and - + and agree to take reasonable measures to maintain the confidentiality of information and any personal data they gain access to in the course of performing the code audit. Both parties will use the information and data diff --git a/xml/source/snippets/offerte/en/examplewaiver.xml b/xml/source/snippets/offerte/en/examplewaiver.xml index f86b794..215aef8 100644 --- a/xml/source/snippets/offerte/en/examplewaiver.xml +++ b/xml/source/snippets/offerte/en/examplewaiver.xml @@ -1,7 +1,6 @@

ANNEX 2 Example Pentest Waiver -

(Full Client Name) (“(Client)”), with its registered office at Somestreet, Somecity, Earth, Milkyway, and duly represented by diff --git a/xml/source/snippets/offerte/en/grey-box.xml b/xml/source/snippets/offerte/en/grey-box.xml index a73f17f..42722a9 100644 --- a/xml/source/snippets/offerte/en/grey-box.xml +++ b/xml/source/snippets/offerte/en/grey-box.xml @@ -2,13 +2,13 @@

The Grey-Box Pentesting Method

- Crystal-Box vs. Black-Box pentesting refers to the amount of - information regarding the target environment, architecture, and/or - applications that is initially shared by the customer with the pentesters. - With Black-Box testing, pentesters are given no information whatsoever about - the target(s). With Crystal-Box testing, pentesters are given all - information requested about the target(s), including source-code (when - relevant), access to developers or system management, etc.. + Crystal-Box vs. Black-Box pentesting refers to the amount of information + regarding the target environment, architecture, and/or applications that is + initially shared by the customer with the pentesters. With Black-Box + testing, pentesters are given no information whatsoever about the target(s). + With Crystal-Box testing, pentesters are given all information requested + about the target(s), including source-code (when relevant), access to + developers or system management, etc..

diff --git a/xml/source/snippets/offerte/en/introandscope.xml b/xml/source/snippets/offerte/en/introandscope.xml index bb8c684..d4f1a64 100644 --- a/xml/source/snippets/offerte/en/introandscope.xml +++ b/xml/source/snippets/offerte/en/introandscope.xml @@ -1,12 +1,17 @@

Introduction -

(hereafter “”), with its registered office - at , , , has requested - (hereafter “”) to perform . - The motivation for this request is that wishes to get a better - insight into ...

+

+ (hereafter “”), with its registered office at + , , , has requested + (hereafter “”) to perform . +

+

+ The motivation for this request is that wishes to gain better + insight into ... +

-

This offer sets out the scope of the work and the terms and conditions under - which will perform these services.

+

This offer sets out the scope of the work and the terms and conditions + under which will perform these services. +

\ No newline at end of file diff --git a/xml/source/snippets/offerte/en/introandscope_retest.xml b/xml/source/snippets/offerte/en/introandscope_retest.xml index ccc5971..143569d 100644 --- a/xml/source/snippets/offerte/en/introandscope_retest.xml +++ b/xml/source/snippets/offerte/en/introandscope_retest.xml @@ -4,11 +4,12 @@

(hereafter “”), with its registered office at , , , has requested - (hereafter “”) to perform .

-

The motivation for this request is that has had a recent penetration - test done by and wishes to check that the vulnerabilities found - have been mitigated. -

+ (hereafter “”) to perform . +

+

The motivation for this request is that has had a recent penetration + test done by and wishes to check that the vulnerabilities found + have been mitigated. +

This offer sets out the scope of the work and the terms and conditions under which will perform these services. diff --git a/xml/source/snippets/offerte/en/methodology_code-audit.xml b/xml/source/snippets/offerte/en/methodology_code-audit.xml index 02b24cf..5530cf7 100644 --- a/xml/source/snippets/offerte/en/methodology_code-audit.xml +++ b/xml/source/snippets/offerte/en/methodology_code-audit.xml @@ -10,8 +10,8 @@ impact on the Confidentiality, Integrity and Availability (CIA) of the system. We will describe how an attacker would exploit the vulnerability and suggest ways of fixing it. -
- This requires an extensive knowledge of the platform the application is +

+

This requires an extensive knowledge of the platform the application is running on, as well as the extensive knowledge of the language the application in written in and patterns that have been used. Therefore a code audit done by highly-trained specialists with a strong background in @@ -21,7 +21,7 @@ During the code audit, we take the following approach:

    -
  1. Thorough comprehension of functionality +
  2. Thorough comprehension of functionality
    We try to get a thorough comprehension of how the application works and how it interacts with the user and other systems. Having detailed @@ -29,7 +29,7 @@ documentation) at this stage is very helpful, as they aid the understanding of the application
    3. -
  3. Static analysis +
  4. Static analysis
    Using the understanding we gained in the previous step, we will use static code analysis to uncover any vulnerabilities. Static analysis means the @@ -47,7 +47,7 @@ assessing the quality of the security measures.
    5. -
  5. Dynamic analysis +
  6. Dynamic analysis
    Dynamic analysis can also be performed. In this case, the program is run and actively exploited by the specialist. This is usually done to confirm diff --git a/xml/source/snippets/offerte/en/methodology_load-test.xml b/xml/source/snippets/offerte/en/methodology_load-test.xml index a4e325f..109b8f7 100644 --- a/xml/source/snippets/offerte/en/methodology_load-test.xml +++ b/xml/source/snippets/offerte/en/methodology_load-test.xml @@ -1,6 +1,5 @@
    - Load testing

    The aim of load testing is to measure what realistic level of performance a service deployment is capable of delivering, or whether it meets a specific diff --git a/xml/source/snippets/offerte/en/planningandpayment.xml b/xml/source/snippets/offerte/en/planningandpayment.xml index 19b2d1b..3fc5918 100644 --- a/xml/source/snippets/offerte/en/planningandpayment.xml +++ b/xml/source/snippets/offerte/en/planningandpayment.xml @@ -1,10 +1,13 @@

    Planning and Payment -

    will uphold the following dates for the planning of the services:

    +

    + + will uphold the following dates for the planning of the services: +

      -
    • performs a on .
      • -
    • delivers the final report .
      • +
    • performs a on .
      • +
    • delivers the final report .

    Our fixed-fee price quote for the above described is .- diff --git a/xml/source/snippets/offerte/en/prerequisites.xml b/xml/source/snippets/offerte/en/prerequisites.xml index 5791d75..5302d85 100644 --- a/xml/source/snippets/offerte/en/prerequisites.xml +++ b/xml/source/snippets/offerte/en/prerequisites.xml @@ -2,7 +2,7 @@

    Prerequisites

    In order to perform this audit, will need access to:

    - +
    • Test accounts
    • Test environment
      • diff --git a/xml/source/snippets/offerte/en/prerequisites_training.xml b/xml/source/snippets/offerte/en/prerequisites_training.xml index 4d13029..8ff8527 100644 --- a/xml/source/snippets/offerte/en/prerequisites_training.xml +++ b/xml/source/snippets/offerte/en/prerequisites_training.xml @@ -2,7 +2,7 @@
      Prerequisites

      In order to provide training, will need to:

      - +
      • Develop training materials
      • Book an appropriate venue
        • diff --git a/xml/source/snippets/offerte/en/projectoverview.xml b/xml/source/snippets/offerte/en/projectoverview.xml index 4aa5cab..b026cd7 100644 --- a/xml/source/snippets/offerte/en/projectoverview.xml +++ b/xml/source/snippets/offerte/en/projectoverview.xml @@ -1,6 +1,5 @@
        - Project Overview

        will perform for diff --git a/xml/source/snippets/offerte/en/projectoverview_retest.xml b/xml/source/snippets/offerte/en/projectoverview_retest.xml index 948b027..082103e 100644 --- a/xml/source/snippets/offerte/en/projectoverview_retest.xml +++ b/xml/source/snippets/offerte/en/projectoverview_retest.xml @@ -1,6 +1,5 @@

        - Project Overview

        will perform for diff --git a/xml/source/snippets/offerte/en/projectoverview_training.xml b/xml/source/snippets/offerte/en/projectoverview_training.xml index 7d26efc..33f9f37 100644 --- a/xml/source/snippets/offerte/en/projectoverview_training.xml +++ b/xml/source/snippets/offerte/en/projectoverview_training.xml @@ -1,7 +1,7 @@

        Project Overview - +

        will provide xxx training sessions, for xxx different groups, diff --git a/xml/source/snippets/offerte/en/teamandreporting.xml b/xml/source/snippets/offerte/en/teamandreporting.xml index 17dad5b..841fc5b 100644 --- a/xml/source/snippets/offerte/en/teamandreporting.xml +++ b/xml/source/snippets/offerte/en/teamandreporting.xml @@ -20,7 +20,6 @@

        The workflow of our penetration testing team is modeled on that of a Capture The Flag (CTF) team: - has a geographically distributed team and we use online infrastructure (RocketChat, GitLabs, etc.) to coordinate our work. This diff --git a/xml/source/snippets/offerte/en/waiver.xml b/xml/source/snippets/offerte/en/waiver.xml index b598401..afa10a0 100644 --- a/xml/source/snippets/offerte/en/waiver.xml +++ b/xml/source/snippets/offerte/en/waiver.xml @@ -1,78 +1,85 @@ - - <company_svc_short/> - WAIVER + + + <company_svc_short/> + - WAIVER + -

        (), with its registered office at , - , and duly represented by

        +

        + (), with its registered office at + , , and duly represented by + +

        -

        - WHEREAS: -

        +

        + WHEREAS: +

        -

        A. wants some of its systems to be tested, - (“”) has offered to perform - such testing for and - has accepted this offer. - The assignment will be performed by ' core-team members, external - freelancers, and/or volunteers (the “Consultants”).

        -

        B. Some of the activities performed by - and the - Consultants during the course of this assignment could be considered - illegal, unless has given permission for - these activities. - and the Consultant will only perform such activities if they have received - the required permission.

        -

        C. is - willing to give such permission to , the Consultants and any - other person might - employ or engage for the assignment.

        -

        - DECLARES AS FOLLOWS: -

        -

        1. is - aware that will - perform of the - following systems of , as described - below. The services are intended to gain insight in the security of these - systems. To do so, - will access these systems, attempt to find vulnerabilities and gain further - access and elevated privileges by exploiting any vulnerabilities found. - will test the - following targets (the “Targets”):

        - -

        2. - hereby grants and - the Consultants on a date to be confirmed by email the broadest permission - possible to perform the assignment, including the permission to:

        -

        a. enter and use the Targets;

        -

        b. circumvent, breach, remove and turn off - any security measures protecting the Targets;

        -

        c. copy, intercept, record, amend, delete, - render unusable or inaccessible any data stored on, processed by or - transferred via the Targets; and

        -

        d. hinder the access or use of the - Targets,

        -

        but - only grants the permission for these activities to the extent that (i) such - activities are necessary to perform the assignment and (ii) such activities - do not disrupt the normal business operations of .

        -

        3. The permission under Article 1 extends - to all systems on which the Targets run, or which or the Consultant might - encounter while performing the assignment, regardless of whether these - systems are owned by third parties.

        -

        4. - warrants that it has the legal authority to give the permission set out - under Articles 1 and 2. It also warrants it has obtained the necessary - permissions from any third parties referred to under Article 3.

        -

        5. Should the public prosecutor initiate an - investigation or criminal proceedings against or any of the consultants it - engaged or employed as a result of the performance of the assignment for the - customer, then will co-operate fully - with in defending - against this investigation or proceedings, including by providing any - evidence it has which relates to this investigation or these - proceedings.

        - - +

        A. wants some of its systems to be tested, + (“”) has offered to perform such testing for + and has accepted this offer. + The assignment will be performed by ' core-team members, + external freelancers, and/or volunteers (the “Consultants”). +

        +

        B. Some of the activities performed by + and the Consultants during the course of this assignment could be + considered illegal, unless + has given permission for these activities. + and the Consultant will only perform such activities if they + have received the required permission. +

        +

        C. is willing to give such permission to , + the Consultants and any other person might employ or engage for + the assignment. +

        +

        + DECLARES AS FOLLOWS: +

        +

        1. is aware that will perform + of the following systems of , as described + below. The services are intended to gain insight in the security of these systems. + To do so, will access these systems, attempt to find + vulnerabilities and gain further access and elevated privileges by exploiting + any vulnerabilities found. will test the following targets + (the “Targets”): +

        + +

        2. hereby grants + and the Consultants on a date to be confirmed by email the broadest + permission possible to perform the assignment, including the permission + to: +

        +

        a. enter and use the Targets;

        +

        b. circumvent, breach, remove and turn off any security measures + protecting the Targets; +

        +

        c. copy, intercept, record, amend, delete, render unusable or + inaccessible any data stored on, processed by or transferred via the + Targets; and +

        +

        d. hinder the access or use of the Targets,

        +

        but only grants the permission for these activities to the + extent that (i) such activities are necessary to perform the assignment and + (ii) such activities do not disrupt the normal business operations of + . +

        +

        3. The permission under Article 1 extends to all systems on which the + Targets run, or which or the Consultant might encounter + while performing the assignment, regardless of whether these systems are + owned by third parties. +

        +

        4. warrants that it has the legal authority to give the + permission set out under Articles 1 and 2. It also warrants it has obtained + the necessary permissions from any third parties referred to under Article 3. +

        +

        5. Should the public prosecutor initiate an investigation or criminal + proceedings against or any of the consultants it engaged or + employed as a result of the performance of the assignment for the customer, + then will co-operate fully with + in defending against this investigation or proceedings, including by + providing any evidence it has which relates to this investigation or these + proceedings. +

        + diff --git a/xml/source/snippets/offerte/nl/crystal-box.xml b/xml/source/snippets/offerte/nl/crystal-box.xml index 00e7579..d153cfa 100644 --- a/xml/source/snippets/offerte/nl/crystal-box.xml +++ b/xml/source/snippets/offerte/nl/crystal-box.xml @@ -1,18 +1,22 @@ - -

        - Crystal-Box vs. Black-Box pentesting verwijst naar de hoeveelheid - informatie over de doelwit omgeving, architectuur, en/of applicaties die de klant - in eerste instantie deelt met de pentesters. Bij Black-Box testing ontvangen de - pentester helemaal geen informatie over het doelwit. Bij Crystal-Box tests - ontvangen de pentesters alle informatie die opgevraagd wordt betreffende het doelwit, - inclusief source code (wanneer dit relevant is), toegang tot developers of systeembeheer, etc... -

        -

        - zal een Crystal-box pentest uitvoeren - de methode die onze voorkeur heeft. - In tegenstelling tot "echte" hackers, die alle tijd van de wereld hebben, - vinden pentests plaats in een beperkt tijdsbestek. Crystal-box pentesting biedt ons - de mogelijkheid om onze tijd zo efficiënt mogelijk te gebruiken, waardoor het maximale aantal kwetsbaarheden kan worden gevonden. - Daarnaast sluit de Crystal-box pentest het beste aan bij de "meekijk"-optie die biedt. -

        - +
        +

        + Crystal-Box vs. Black-Box pentesting verwijst naar de hoeveelheid informatie + over de doelwit omgeving, architectuur, en/of applicaties die de klant in + eerste instantie deelt met de pentesters. Bij Black-Box testing ontvangen de + pentester helemaal geen informatie over het doelwit. Bij Crystal-Box tests + ontvangen de pentesters alle informatie die opgevraagd wordt betreffende het + doelwit, inclusief source code (wanneer dit relevant is), toegang tot + developers of systeembeheer, etc... +

        +

        + + zal een Crystal-box pentest uitvoeren - de methode die onze voorkeur heeft. + In tegenstelling tot "echte" hackers, die alle tijd van de wereld hebben, + vinden pentests plaats in een beperkt tijdsbestek. Crystal-box pentesting + biedt ons de mogelijkheid om onze tijd zo efficiënt mogelijk te gebruiken, + waardoor het maximale aantal kwetsbaarheden kan worden gevonden. Daarnaast + sluit de Crystal-box pentest het beste aan bij de "meekijk"-optie die + biedt. +

        +