When Penetration Testing Isn't Penetration Testing at All
Ted Harrington challenges industry misconceptions around penetration testing, contrasting commoditized vulnerability scans with true adversarial assessments.
Summary
The Misuse of the Penetration Testing Label
The term 'penetration testing' is frequently commoditized across the security industry, with automated vulnerability scanner reports marketed as comprehensive security assessments.
Vulnerability Scanning vs. True Adversarial Penetration Testing
Ted Harrington distinguishes surface-level compliance scans from deep, threat-modeled penetration tests that chain complex logic flaws across IoT ecosystems.
Threat Modeling Connected Hardware Systems
Harrington outlines the essential phases of effective IoT testing—including attack surface mapping, threat modeling, exploit development, and root-cause analysis.
Building Resilient Security Testing Programs
The presentation provides enterprise buyers and product developers with practical guidelines to evaluate security vendors and demand high-impact testing.
Related talks
Village Interviews·1 min
A tour of the IoT Village at DEF CON 32 exploring hands-on router hacking, connected device vulnerability research, and zero-day labs.
IoT Village·31 min
Sanjana Sarda
Offers practical guidance and methodology for young security researchers starting out in IoT vulnerability hunting.
DragonJAR - Hacking y Seguridad Informática·1 hr 2 min
Explores explotación práctica de vulnerabilidades en dispositivos IoT: un pentesting por el mundo real and evaluates key implications for security practitioners.