Choosing what to test before a business system goes live

This is a fictional learning scenario. It does not describe a Cyberxperts client, incident or completed engagement.

The situation

Consider an organisation preparing to launch a business application. Its technical team wants an independent security test, while management needs to understand what the report will cover and who will deal with the findings.

The proposed scope

Before testing, the organisation would identify authorised targets, account types, important business functions and exclusions. The system owner and testing team would agree permission, timing, escalation contacts and conditions for stopping work. Systems controlled by other parties would require the appropriate authorisation.

The proposed work

Testing would follow the agreed boundaries. Findings would describe the weakness, supporting evidence, relevant risk and possible remediation. Sensitive technical detail would be shared through an agreed channel with authorised recipients.

What would demonstrate progress

The organisation would assign responsibility for the findings, record decisions and arrange verification of agreed fixes. The report should make its scope and limitations clear. Testing provides evidence about the systems and conditions examined; it does not certify that an application can never be compromised.

Apply this to your organisation

Use our assessment preparation guide to prepare for scoping. Explore Penetration Testing or complete the complimentary Pre-Assessment.

Download the assessment preparation guide PDF to prepare for the scoping discussion.

Further reading

GOV.UK guidance on vulnerability and penetration testing explains testing scope, permission and reporting. Its government specific requirements are not presented here as South African requirements.