I'm part of a team that's been asked to penetration test an application that is not GA or even at a release candidate yet. I believe that any pen test findings, positive or negative would be invalid since the underlying code could change drastically between testing and general availability. The development organization's view is they have fixed some vulnerabilities in the upcoming release and want to verify that is true and determine if any new vulnerabilities have been introduced.

My questions:

  • Are there any standards or guidelines for what constitutes a valid penetration test?
  • Are there any best practices or guidances around pentesting alpha/beta level software that hasn't hit GA?

NOTE: I'm looking for guidelines on what makes a pen test valid or what actions invalidate it.

  • 2
    You can study owasp methodologies owasp.org/index.php/Penetration_testing_methodologies – mootmoot Jul 19 '18 at 13:32
  • 2
    It's valid if someone considers it to have value - it's very subjective. It's also a term which is used for a whole range of different types of work, anything from examining code looking for potential means of ingress to full on red teaming, where a group is pointed at a company and told "what can you do?". They might want to know if devs are paying attention to previously identified flaws, or if layers which would normally be buried are as secure as possible. – Matthew Jul 19 '18 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.