The users of the application will be the company employees who will access it over the company network and outside too. A penetration test needs to be done on the staging environment which will be done by a different team inside the company network. I want to know if there are any risks invovled if the staging environment is put over the internet.

3 Answers 3


I would ensure that the penetration testing team tests both access from within the internal network and from the internet. By exposing an application to the internet, you are making access to that application by threat agents (attackers) easier, so yes, this would affect the risk profile of the application. To calculate the risk, consider a threat modelling approach. You might find OWASPs approach useful.


It mainly depends on the trust you put on the staging environment, but in the general case, exposing it to the internet adds risks. Because in addition to the team that will the the tests, other attackers could access the application, and if they find vulnerabilities exploit them. This would not be a big surprise because the pen tests have not still be done. If the staging environment is isolated from the internal network by being configured as a DMZ, the risk if limited to this platform, but if it can access the internal network, it could be then used to attack other (internal) machines, acting more or less as a trojan.

If the team that should do the pen test has no direct access to the internal network, you should considere setting up a secure VPN to allow them to access the staging environment, but nobody else.


An attacker could "practice" their exploits on the staging copy which is often not monitored/defended until they have perfected their exploits, at which point they can take down your live application in one shot.

Another risk would be if there's some configuration mistake and the staging app actually contains secrets that would be valid on the live app at some point. I've recently encountered exactly this on a recent job - the staging app used the same passwords for an external service as the live app.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .