Introduction

Pentest Program

External Pentest process

Schedule

1. At least once a year a pen-test must be completed
   
1. Major changes that impact the Azure DRE Shared Tenant security boundaries might trigger an ad-hoc pen-test
   
2. If a scheduled pen-test should take place within six months of an ad-hoc pen-test and no security boundary changed, a pen-test can be skipped but must be logged in Policy Exceptions
   
2. Every year a pen-test will take place in the 1st quarter, but must be completed before March 31st.
   
3. On or before December 1st the CTO will provide the scope and target areas.
   
4. On or before March 15th the pentest must be completed.
   
5. On or before June 1st the results, findings and recommendation must be presented to anDREa’s Management Team and Dev-Team
   

Procedure

1. The CTO examines and performs a risk analysis with dev-team and members of CST on but not limited to the following documents:
   
1. Architecture
   
2. Risk and Incident findings
   
2. The CTO will assess risks based on interviews with the following roles:
   
1. MT
   
2. (Core) Support Team
   
3. Service Provider
   
4. Representatives 
   
3. The CTO will
   
1. Update the documentations in Documents for Pentester
   
2. Create sub folder of Pen-Test > General > Dossiers
   

1. The purpose of the Pentest
   
2. The responsibility and duties of Pentesters
   
3. Give access to and provide instructions:
   
1. Documents for Pen-Tester
   
2. Sub folder of Pen-Test > General > Dossiers
   

1. PenTester logs findings and report in sub folder of Pen-Test > General > Dossiers
   

1. CTO reviews findings and recommendations with dev-team and CST
   

1. CTO with MT and decide on actions
   
1. Actions will be logged in Risk, Incidents and Treatment Plan Register
   
2. When there are no more follow-up questions
   
1. CTO removes Pen-Tester from Pen-Test Teams
   
3. CTO updates Approvers > Audits and informs relevant stakeholders

Internal Pen-Test process

Schedule

1. Internal Pen-Test are ad-hoc driven and must occur when:
   
1. Major change has been implemented that impact security boundaries
   
2. Suspected unknown weakness
   
3. Reported unknown weakness
   

Procedure

1. The CTO examines and performs a risk analysis with dev-team and members of CST on but not limited to the following documents:
   
1. Architecture
   
2. Risk and Incident findings
   
2. The CTO will assess risks based on interviews with the following roles:
   
1. MT
   
2. (Core) Support Team
   
3. Service Provider
   
4. Representatives 
   
3. The CTO will
   
1. Update the documentations in Documents for Pen-Tester
   
2. Create sub folder of Pen-Test > General > Dossiers
   
3. Assign one or more pen-testers
   

1. The internal pen-tester(s) writes a plan, this must include:
   
1. Approach & methodology
   

1. Explain:
   
1. The purpose of the Pen-Test
   
2. The responsibility and duties of Pen-Testers
   
2. Give access to and provide instructions:
   
1. Documents for Pen-Tester
   
2. Sub folder of Pen-Test > General > Dossiers
   

1. Pen-Tester logs findings and report in sub folder of Pen-Test > General > Dossiers
   

1. CTO reviews findings and recommendations with dev-team and CST
   

1. CTO with MT and decide on actions
   
1. Actions will be logged in Risk, Incidents and Treatment Plan Register
   
2. When there are no more follow-up questions
   
1. CTO removes Pen-Tester from Pen-Test Teams
   
3. CTO updates Approvers > Audits and informs relevant stakeholders

Access to Pentest Results

1. All Security Officers of a Tenant can request the CTO for access the Pen-Test Reports
   
2. People with an account on support.mydre.org and part of the group Approver have access: https://support.mydre.org/portal/en/kb/approvers/audits