Establish and Document the Application's Penetration Testing When Required

This chapter explains how to establish and document penetration testing for Applications that require it.

When Penetration Testing Is Required

Penetration testing, in which authorized testers attempt to exploit an Application’s weaknesses as an attacker would, is typically required for Applications that are exposed to the internet, hold sensitive or regulated data, are business-critical, or are subject to regulations or contracts that demand it. The enterprise’s conditional practice criteria determine which Applications require it, and how often.

Establish Penetration Testing

For Applications that require it, establish the testing scope, the Instance or Instances to be tested, the frequency, the triggers for additional tests (such as major architectural changes), who performs the tests, how findings are rated, and the remediation deadlines for each rating.

Document and Share Penetration Testing

Record each penetration test as a security review, with its scope, date, tester, findings, and remediation status, as described in the chapter “Establish and Document the Application’s Security Reviews and Remediations.” Restrict access to detailed findings, and keep summary status visible to the Application’s owners.

Best Practice: Establish and Document the Application’s Penetration Testing When Required

It is a best practice to both establish and document the solution for testing an Application’s defenses where its risk requires it: define scope, frequency, triggers, and testers, and record each test’s findings and their remediation, with detailed findings restricted.

Benefits: Penetration testing finds exploitable weaknesses before attackers do, and documented remediation proves that they were closed. Applying it according to defined criteria ensures that the Applications attackers are most likely to target are the ones tested most thoroughly.

Connections to Related IF4IT Practices and Inventories

The Application Portfolio Management (APM) Best Practices addresses assessing the security posture of every application in the portfolio.