How to prepare for a penetration test

A little preparation saves days. Use this list before the test starts.

Before

• Decide what is in scope (applications, APIs, networks) and what is not.
• Give written authorisation, including the dates and the source addresses we will use.
• Say if any system is fragile or must not be tested at certain hours.
• Name a contact who can answer quickly during the test, and one for emergencies.

Access

• Provide test accounts for each user role, not only an administrator.
• Prefer a staging environment with realistic data, never real customer data.
• Check that firewalls and monitoring will not block the testers without you knowing.

During and after

• Tell your monitoring team, or decide to leave them unaware on purpose.
• Plan time to fix issues and to re-test them: a test is only complete when fixes are verified.