How to share penetration tests results + remediation plan to third party companies without exposing one's self

Question

We are integrating our services with 3rd party companies (ie customers are able to buy the products of third party companies on our platform). These companies are asking us to provide to their security teams a penetration test.

Although we have several quotes from security companies for them to provide penetration tests for us, I had our in house dev-ops guy run a basic penetration test (to save money) and he created a basic report listing the vulnerabilities and our remediation plan.

My question is: can I just provide this test to the third party companies? Doesn't this expose our system's vulnerabilities and if it falls in the wrong hands, can cause a lot of harm to my company (for example, I'm not even sure about their security best practices, how do I know that they won't just leave the report lying around somewhere. What if due to negligence it falls in the wrong guys hands, will they take responsibility for that)?

Answer 1

Normally, these kind of audits simply require an executive summary to be disclosed.

While security by obscurity is a universally recognized anti-pattern, it doesn't mean you have to disclose full details of your vulnerabilities.

Problem 1: the self assessment

I trust the professionality of your DevOps guy. Without having to offend his skills, most external companies demand a reputable third party to perform the security assessment.

Your DevOps guy can be honest and professional, and provide real insights on the security. Or your DevOps guy can be insufficiently educated on security and miss important vulnerabilities. Or your DevOps guy can be a former Volkswagen employee (please, please, allow me some humour sometimes) and pretend there are no vulnerabilities just to make a good impression.

This is why companies demand an external trusted and reputable party

Problem 1.5: the cheap assessment to save money is a clear indicator that this penetration test is unlikely to work, irregardless that it found real security holes.

If you hire a reputable security company, they will do a more thorough test.

Problem 2: what to disclose

In general, these external suppliers/customers want to get an indication of your security levels to have business with your company.

An executive summary (that is, literally, a summary made to be read by high-level executives that don't work with technical things) contains a list of known vulnerability types associated to a severity score.

It doesn't contain details on how to exploit those.

Problem 3: mitigation

Please expect the suppliers to demand you to fix high-level vulnerabilities and re-assess the sytem.

Often they require to fix vulnerabilities rated >= 6 or 7, depending on the requirements. And then you will have to go through another scan and confirm the agreed vulnerabilities are not present anymore in the system

My case

Source: I was directly involved in such an activity.

In the past years, we had a code scan from Veracode as requested by one of our US customers before deploying our code on their premises. Veracode is not a penetration test, it is an automated code static analysis tool. We had real pen-tests but they are out of the scope of this example.

It was part of the contract to share the full report with the customer, as they happened to sponsor the scan.

Later, we had an audit request from a Swiss bank we wanted to have business with, but they didn't request to perform a security scan, they just demanded that we did and provided an executive summary.

We responded with the front page of that Veracode audit, displaying their logo and our company name. A few pages later, a table showed the list of remaining vulnerabilities (yes, we had, and yes, we fixed high-priority ones!) that were all scored < 6 out of 10. We gave that to our prospect as well.

We knew exactly where our vulnerabilities were, because Veracode highlighted file name and line number of suspect code. We never had to disclose such details to Swiss customer.

I don't know what happened next, but probably we got the contract. I should ask my Sales Account Manager for details

Answer 2

This is very dependent on your contract with those companies. Apparently, there are provisions in it that allow those companies to ask for such a pentest. In general: if the contract stipulates that they can ask you for a pentest, you must provide it when asked. Whether you (as an individual) trust or distrust those companies (and whether that is justified or not) is immaterial. If you have serious doubt, consult the legal people that drafted the contract.

What you share must also conform to the contract. We normally ask an independent security company to do pentests and we require that from our contract parties too. We would not be satisfied with such a self-assessment, how professional your IT person might be. Speaking for myself: I would not be satisfied with a simple listing of vulnerabilities and remediation plan. I would need at least the scope of the pentest, the methodology for testing and a risk assessment.

Ideally, the report that you share shows only minor issues. The report should be a proof that your security is correctly set-up. Legal people that draw up contracts see it that way.

If the report contains information that is embarrassing or dangerous, then your security practices were something you need to look at anyway. You should fix the embarrassing points and gaping holes immediately; aside form the pentest, they pose a security risk. You can re-do the pentest when the major issues are fixed, and just share the second report.

Answer 3

To focus on your specific question, your contract with the third parties should include a non-disclosure agreement (NDA). That NDA should state that where each party is in receipt of confidential information (e.g. a pentest report) that they keep it secure and don't disclose it externally.

In terms of exposing the issues in your system, what typically happens in these situations is that what's shared is a high-level summary. It should state something like "we had this kind of review done, of these systems and here's a summary of the issues found". That gives the 3rd party the comfort that you've had work done and that you know where your issues lie.

You can also provide them with information to show how you're addressing the issues.

On the wider point of who you get to do it, there's a risk that a 3rd party won't be satisfied with an internal review, as it could be considered "marking your own homework" and instead would like an independent review. Most pentest firms will be used to this and should be able to provide a cut of their report which is suitable for sharing with third parties.