Create a penetration test assessment request (prior to v19.0)
Initiate a penetration test assessment request for your web applications or APIs. These requests are submitted to the ethical hacking team, who then proceed to test these applications and manually report the penetration test findings.
Before you begin
Role required: App-Sec Manager
About this task
The application owner raises a penetration test assessment request to manually scan their application or APIs. The ethical hacking team tests the application and manually creates penetration test findings. These findings are manually-created application vulnerable items (AVIs).
The default assignment group for the penetration test finding is the group configured in the 'Application team' field of the associated penetration test assessment request. The assignment type of the penetration test finding is Manual. The assignment rules cannot override the assignment of these penetration test findings.
Starting with v19.0, you can create penetration test assessment requests directly from the Penetration Test Assessment Requests [sn_vul_pen_test_assessment_request_list] table. See Create a penetration test assessment request from existing requests (v19.0) for more information.
Procedure
Prior to v19.0, navigate to All > Self-Service > Service Catalog > Services > Penetration Testing Assessment Request.
Alternatively, you can create a request by replicating closed requests.
All the values from the original request are preserved. Active application vulnerable items (AVIs) are automatically copied to the new request.
On the form, fill in the fields.
| Field | Description |
|---|---|
| Number | Unique identifier generated for the penetration test assessment request. |
| Requested by | Person requesting the assessment of the application. |
| Parent assessment request | Original penetration testing assessment request used to create the child request. It is created using a closed assessment request. Visible only on the child assessment request form. |
| Application | Select an application using the search option. |
| Application type | Select an option from:- Web Service \(known as API prior to v16.1\) - Web Application - Thick Client - Mobile \(If you select Mobile, the Mobile tab is displayed at the bottom of the form with additional fields\) |
| v19.0: Application size | Select the size of the application you want to test.- Small - Medium - Large - Standard \(select this option if you are not sure of the size\) |
| Assessment type | Select the type of assessment from:- Full penetration Test - Focused Test - Re-test For details, see Configure assessment types for penetration testing. |
| Purpose of application | Description of the application’s functionality. |
| Technology stack details | Complete technology stack from front-end to back-end, databases, and other key technologies. |
| Is third-party application? | Confirms if this application is owned by a third-party vendor. |
| List types of sensitive data accessible from application | Types of sensitive data accessible from the application. For example, PII data, PHI data, and financial data such as credit card numbers. |
| Authentication type | Specifies if this application uses LDAP authentication, its own native authentication, or other forms of authentication. |
| Is application in scope for any compliance program? | Specifies if this application impacts any compliance programs such as PCI. |
| Application team contacts | Members of the application team to be contacted by the ethical hacking team for any questions. |
| Demo date | Date when this application can be demonstrated. |
| Product deployment planned on | Planned date to deploy this application in production. |
| Application version/release planned for deployment | Version of the application planned for production deployment. |
| v19.0: Application owned by third-party vendor or a joint venture | If you select Yes for this field, the Vendor/ Joint Venture Information tab is displayed with additional fields.The term 'Clause' might refer to standards for testing that include any agreements that exist between two or more parties. |
| State | Select a value based on the status of the request. |
| Assignment group | Group selected to work on the penetration test findings. Can be manually added or edited by an App-Sec Manager. |
| Assigned to | Individual from the selected assignment group that works on the penetration test findings. Can be manually added or edited by an App-Sec Manager. |
| Sprint | Displays the sprints with bandwidth available to accommodate the assessment request based on the selected Assessment type field. |
| Created | Date and time the request was created. |
| Testing start date | Date and time when the testing begins. |
| Updated | Date and time the request was last updated. |
| Testing details | |
| URLs to test | URLs that must be included in penetration testing. |
| URLs to exclude | URLs that must be excluded from penetration testing. |
| Was this application tested previously? | Specifies if this application has already been penetration tested. |
| Reason for retest | Reason for asking for a penetration test reassessment if the application was tested earlier. |
| When was the application tested? | Timeframe when the application was penetration tested. |
| Test account details | Details of the test account that can be used by ethical hacking team for penetration testing. |
| Application roles | Roles supported by the application for its users. |
| Most used roles | Most commonly used roles in the application. |
Select Submit.
An email notification is sent to the ethical hacking team that the request has been created for the relevant application.