Dave Elkins

Here is an interesting article by Bruce Schneier about the benefits and issues with penetration testing – “Is Penetration Testing Worth It?”.

I think it makes a lot of sense.  I have been researching what types security testing tools are out there and wondering what is the best way to test for security flaws.

Is it better to take outside approach where you look at the system from an attackers perspective?  Or is it better to look from the inside and use all the information available to identify areas where you may be venerable?

I would think the latter would be better because you have more information to work with.  I think it is better to restrict your attack surface, make a security plan and focus on the top venerabilities like Bruce Schneier suggests.