20

A potential client is planning to do penetration testing on our SaaS.

Is it standard or fair for us to request things like the following?

  • An NDA from the pen tester
  • Details on who is performing the test (e.g., verifying they are accredited)
  • Restrictions (like no social engineering, DoS attack, etc.)
  • Targeting a staging server instead of production
  • A copy of the full report
1
  • 4
    Do you already, maybe on a regular basis, perform independent pen tests on your SAAS? If yes, did you ask the question to the potential client whether they might be OK with a report from these pen tests of yours? – Laurent S. Nov 20 '20 at 15:42
26

Non-Disclosure Agreements

A NDA is a fairly standard thing in most penetration tests. No serious penetration tester will protest against an NDA.

The company conducting the penetration test may later approach you and ask you for your permissions to anonymously talk about the findings at your company for educational purposes, which you can always deny if you feel it would harm your business.

This could look like "In a penetration test for ACME Corp., we were tasked with testing a SaaS solution. During the test, we found that ..."

Details on who is performing the test

It makes sense to know who the actual testers are, just in case you need to contact them directly for one reason or another. However, you should keep in mind that not all penetration testers have certifications yet, especially those who just started out. So it could very well be that a company may decide to also assign a newly hired penetration tester to the project so they get more experience, in addition to an already experienced team.

Restricted Scope

This is also very usual to see in penetration test projects. It's up to you to define the scope of the assessment, and as such also what kinds of tests a penetration tester is allowed to perform.

Testing Environment

Again, the scope is up to you. If you say you would rather offer a staging server than production, that is very reasonable. In fact, I always prefer testing on staging than on production environments, because I don't want to be the reason thousands of customers suddenly can't access their software anymore, simply because some exploit code I ran crashed a machine by accident.

A copy of the report

That's another reasonable request to make. In fact, you're getting a penetration test done on your software and you don't even have to pay for it. That's a win for you!

2
  • What @MechMK1 said above, plus make them inform you and settle on a specific IP or set of IPs that the test will be launched from, timing of tests, and of course as mentioned, scope of testing. If the pentester is worth his snuff, he should be approaching you with an approval document (get out of jail free card) that will explain all of the above detail. – SysRisk Nov 20 '20 at 3:55
  • The "approval document" you speak of is called "Permission to Attack" and it has to be signed by the system owner (OP in this case) anyways. – MechMK1 Nov 20 '20 at 11:27
10

All those are normal things for you to request. The options are also up to you and what risks you want to accept and what mitigations you want.

It's also acceptable to tell them 'no'.

What I did when I worked at a SaaS company was to employ our own pentester and made their report available to potential customers under an NDA. Far fewer risks that way and you have more control.

2
  • 6
    This is obvious but still worth mentioning: it's also the prospect's right to walk away if they don't like the terms they are given. To be fair, the terms laid out in the OPs question are all very reasonable. – Conor Mancone Nov 19 '20 at 15:27
  • 5
    @ConorMancone I had Fortune 500 orgs insist with all their might to pentest us. But they all changed their stance when I wouldn't back down. Customers might walk away. But if they want your service, an extra pentest is not going to be a blocker. – schroeder Nov 19 '20 at 15:30
6

Yes, it is absolutely standard and fair for you to request those items. You should go a step further and have a contract in place that includes a non-disclosure agreement and scope of testing.

Having a discussion with the penetration testing service can illuminate this document; you can work with them to determine what should and should not be tested. Begin by thinking of things you definitely do and do not want tested. They can make recommendations and guide your scope. Of course, you should have buy in from your executives.

A brief anecdote: our testers asked us for permission to install a keylogger on the machine of our CTO and I gave them the green light. When I informed my manager, thinking "Sure, he'll approve this," he quickly changed the light to red and and told the testers to pull the device. Lesson learned: work with management to determined what's in scope.

Additionally, you will want to have a remediation plan in place, so make sure your departments know what's up and are prepared for the work to come.

Finally, for reporting, you should absolutely get a full report of their discoveries. Also, make sure you get a client facing document. This can be a glowing review that communicates to your clients that you take privacy and security seriously. This can also expedite sales velocity. The service should also do a re-test after you've remediated (within three to six months). Our service doesn't charge for this but some may. Bring this up with them and see what they say.

Good luck, and engage with the testers. They often like it when you show interest and help them help you!

2
  • 3
    Note that the testing entity is their potential customer. This isn't a case of the company engaging a pentesting service. – schroeder Nov 19 '20 at 15:52
  • Noted, thanks @schroder. That's what I get for trying to multitask! – pancake-house Nov 20 '20 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.