6 things to do before getting a penetration test

The fourth point is spot on. A third of our first report was due to missing updates. We were embarrassed.

Adding to the third point from an ops perspective: the person on call shouldn't have other tasks that day.

Here's what happened to us: the colleague on call had a shipping meeting on test day, and when the system slowed down, nobody noticed for twenty minutes. No one's fault, just a planning error.

I have a question, don't want to go off-topic though. When you try to change everything at once, nothing settles.

I'm also curious if anyone does it differently.

Following.

Quick summary for newcomers: Your time to detect an issue directly determines its cost.

This is my opinion, I'm not claiming it's absolute truth.

We got stuck at the same point for a while. Taking notes for two weeks yields better results than a six-month estimate.

If you post the result here, it will help others too.

We got stuck at the same point for a while. If 2FA is on, a stolen password alone is useless.

If you post the result here, it will help others too.

Thanks this was very helpful. Hasty decisions become decisions you have to fix six months later.

Having backups accessible on the same network and with the same identity makes them part of the target. Of course it varies if your situation is different.

This thread is archived.

I agree, and I'd like to emphasize that. like mistakes made on the pentest side are usually reversible but expensive.

Hope this helps.

Don't miss this: An untested backup is not a backup.

great work. i mean if permission and scope aren't in writing don't start that test.

if you post the result here, it will help others too.

Three different views emerged, they all complement each other. Hasty decisions become decisions you have to fix six months later.

Having backups accessible on the same network and with the same identity makes them part of the target. If I were you I'd go this route.

thanks for posting and i mean if it's your first time, start small; scaling coes later.

the answer varies greatly by industry; there is no one-size-fits-all rule. this is my opinion, I'm not claiming it's absolute truth.

I can't fully agree with this. Everything goes well for the first three months; problems arise in the fourth.

Hope this helps.

This is exactly what we experienced. The real issue isn't the number but what it's based on.

Hasty decisions become decisions you have to fix six months later. Proven by experience.

Let me summarize what's been said so far. Trying to do this alone is the most expensive way.

Correct me if I'm wrong.

let me speak from the other side; Im on the supplier side and trying to do this alone is the most expensive way.

if 2FA is on, a stolen password alone is useless. tbh this is my opinion, I'm not claiming it's absolute truth.