Originally posted here by HTRegz
I'm not a big fan of having internal employees audit a network... but there is a big IF to that.... if they are the network department... If you have a security group that is in no way, shape or form related to the network department... then it's a great idea... but having the network department do the pentest (I've known companies that do this) is useless... Obviously they are going to secure the systems as much as they can and as best they can... so they aren't going to get into them...
Do you still feel this way if it is another group within the company doing the Pen Test? For example, if the auditing department worked as an independant function of Finance instead of IT?

Good discussion points so far. Keep 'em coming! Thanks!

-Deeboe