Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
What do Enterprise Security teams test when they buy third party products, before they sign the check?
Presumably they have a standard despite the main protection being the firewall and IDS. Is there a standard of security they want their internal services to adhere to?
Specifically I'm asking about industrial management software, not software that stores or access personal data.
Data classification will largely drive the requirements. An enterprise will adopt a data classification system to help identify which systems need which protections. We can assume your question applies to sensitive data. Even then, different requirements apply depending on the source of that data and the classification.
Sometimes, outside forces dictate the requirements. For example, due to the type of data we work with, we are audited every year by an outside party. They require, among other things, that we pass scans by Nessus and AppDetectivePro. So, to ensure we pass, we run those tools against systems in scope.
"Before you sign the check" is the time where an enterprise would make sure they have permission to do the required tests. For example, the contract might require the vendor to provide a test environment to run invasive application security scans. The procurement process might require that these scans be allowed before the product is purchased.
Vendors can be asked for proof that they've complied with standards. For example, vendors to the federal government must meet FedRAMP requirements. Cloud vendors are judged against SOC 2 requirements.
Security refers to Confidentiality, Integrity and Availability and that is what you are going to test. It depends on what the enterprise will be using the software for. A risk based approach is what I would recommend because irrespective of what you are using it for, the benefits must outweigh the risks that the software will bring. So if you are purchasing an enterprise software which is going to house PII, confidentiality must be beyond reproach and thats what you will test.
