What do Enterprise Security teams test when they buy third party products, before they sign the check?

Presumably they have a standard despite the main protection being the firewall and IDS. Is there a standard of security they want their internal services to adhere to?

Specifically I'm asking about industrial management software, not software that stores or access personal data.

  • Every enterprise is different and will have different standards. Some enterprises must adhere to various 3rd party regulations and standards, too. Their "main concerns" are that the products adhere to the policy they have set in order to reduce risks. – schroeder Oct 24 '18 at 8:00
  • So, SCADA? If so, there are well-established assessment criteria – schroeder Oct 24 '18 at 9:58

Data classification will largely drive the requirements. An enterprise will adopt a data classification system to help identify which systems need which protections. We can assume your question applies to sensitive data. Even then, different requirements apply depending on the source of that data and the classification.

Sometimes, outside forces dictate the requirements. For example, due to the type of data we work with, we are audited every year by an outside party. They require, among other things, that we pass scans by Nessus and AppDetectivePro. So, to ensure we pass, we run those tools against systems in scope.

"Before you sign the check" is the time where an enterprise would make sure they have permission to do the required tests. For example, the contract might require the vendor to provide a test environment to run invasive application security scans. The procurement process might require that these scans be allowed before the product is purchased.

Vendors can be asked for proof that they've complied with standards. For example, vendors to the federal government must meet FedRAMP requirements. Cloud vendors are judged against SOC 2 requirements.


Security refers to Confidentiality, Integrity and Availability and that is what you are going to test. It depends on what the enterprise will be using the software for. A risk based approach is what I would recommend because irrespective of what you are using it for, the benefits must outweigh the risks that the software will bring. So if you are purchasing an enterprise software which is going to house PII, confidentiality must be beyond reproach and thats what you will test.

  • This answer is far too generic to be useful. Can you expand or get more specific? – schroeder Oct 24 '18 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.