Every now and then we hear that the Methodology for Information Security Research with Audit Value (MIAW) would make penetration tests (pen tests) more expensive. But is that really the case? I would like to explain why MIAUW contributes to transparency, quality and in many cases even results in cost savings.
What is MIAUW?
MIAUW is a structured methodology for carrying out penetration tests (technical security research). Where the customer often does not know what to ask and how to get real guidance, MIAUW helps with purchasing requirements and requirements for research, with an emphasis on transparency, reproducibility and audit value. It provides organizations with a clear framework to plan, conduct and evaluate pen testing, and ensures that all key aspects of a security investigation are documented. This is essential to comply with legislation such as the GDPR, NIS2 Directive and the upcoming Cyber Resilience Act (CRA). This legislation requires those responsible in the organization (the director) to demonstrate that you comply with the legislation.
MIAUW does not make security investigations more expensive
MIAUW does not make security investigations more expensive, but helps ensure compliance
Occasionally, angry tongues claim that it would increase the cost of pen testing. But where does this idea come from? This argument is based on a number of misunderstandings. That is why I would like to explain the cost aspects of MIAUW:
- More obligations do not always mean higher costs. MIAUW requires testing of basic security standards. If that makes it more expensive, what was tested before? Fewer? Not the basics? A pen test without these basic checks is simply incomplete. Unfortunately, there are several known examples of technical security investigations carried out shortly before an incident took place. The attack was not grand and compelling, but simply on the basics, which had not been checked.
- Reusability does not make it more expensive, but saves costs. MIAUW provides reusable pen tests. By using an auditor’s report, an organization can demonstrate that a previous test is reliable. This prevents the same software from having to be tested over and over again.
- Structured working is efficient working. A structured approach such as MIAUW ensures that nothing is overlooked. This leads to more efficient work and less chance of errors, which ultimately saves costs. Unstructured testing leads to more effort to achieve the same thing or even worse: not doing important research.
- The costs of an auditor’s report are limited, but the value is great. An auditor’s report costs a little extra, but offers a lot of value. It provides clear and reliable insight at administrative level and prevents time-consuming discussions.
- Free models and documents. All models and documentation for MIAUW are available for free. It is available open source. This lowers the entry barrier for organizations that want to apply the methodology. You also do not have to pay per pentest when using it. As a customer, you (hopefully) do not have to pay costs that your supplier does not incur.
- Tools to speed up reporting. Tools are made available that simplify the preparation of a report. This saves time and minimizes the administrative burden. For example, we recently heard that creating an overview of available files with a checksum (control number) would increase the price. These are precisely things that are very easy to automate and therefore do not save time. To help suppliers who find this complicated, we make a script available to remove that complexity.
Why MIAUW actually saves costs
The core of MIAUW is to provide clarity and transparency. This prevents duplication of work and ensures that organizations know exactly what has been tested, how it has been tested and what findings have been recorded. This makes it possible to make more informed decisions and prevents costly misunderstandings.
The idea that MIAUW makes pen tests more expensive is based on a misunderstanding. In reality, MIAUW offers structured and transparent pen tests, which increase reliability and are cost-saving in the long term. Companies that apply MIAUW gain insight, control and reduce their risks, ultimately leading to more efficient and effective security.