Schellman becomes The First ISO 42001 ANAB Accredited Certification Body!

Services
Services
SOC & Attestations
SOC & Attestations
Payment Card Assessments
Payment Card Assessments
ISO Certifications
ISO Certifications
Privacy Assessments
Privacy Assessments
Federal Assessments
Federal Assessments
Healthcare Assessments
Healthcare Assessments
Penetration Testing
Penetration Testing
Cybersecurity Assessments
Cybersecurity Assessments
Crypto and Digital Trust
Crypto and Digital Trust
Schellman Training
Schellman Training
ESG & Sustainability
ESG & Sustainability
AI Services
AI Services
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Higher Education & Research Laboratories
Higher Education & Research Laboratories
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility
Strategic Partnerships
Strategic Partnerships

How to Set Your Penetration Test Scope

Setting the scope correctly is the number one thing you need to worry about when you're starting the process of choosing a pen test provider.

Why does everyone harp on scoping with timing and pricing??

Hi, I'm Josh Tomkiel, I'm a senior manager here at Schellman on the pen test team. I've been in the industry for over 10 years, started off as a penetration tester working on web applications and internal and external networks. And now I'm on the manager side overseeing projects.

So you've decided you're going to have a penetration test performed, you're going out talking to vendors, getting estimates. But the first thing that everybody asks you: "what's the scope? What's the scope?" Why is it so important? It's important because the scope dictates:

  • how long the engagement is going to take
  • how many resources or pen testers need to be assigned to your project in order to give you a quality deliverable?
  • How many applications?
  • How big are the applications?
  • Do the web apps have multiple features?
  • Are there different roles, user types, and permission levels?
All that stuff matters because as the pen tester, we're going to log in to each one of those roles and make sure that there are certain controls in place and authorization checks that won't let us get the data that we're not supposed to.

So it takes a very long time. Automated tools are included when performing a pen test, but 90% of it is very manual, especially on the web app side, where we're processing each request from the application, tampering with it in most cases, and seeing what the underlying server does.

If you don't set the scope correctly, two things can happen.

  1. You won't get the most value from your pen test. You'll get a false sense of security. Oh, I only have one web application in scope and you guys didn't get credit credentials, so you can't even log in. Oh, good. The pen test report says no findings to report. All right. Nothing else to do here. But that's not very good because the scope was not set accurately. We got to log in. We got to see what's there. We've got to assess the application from an authenticated perspective to get the most understanding of the overall attack surface. Same thing with networks or mobile apps. If you exclude certain hosts from the scope, you won't get the complete picture and value that a pen test can provide.
  2. Now, if there's a compliance initiative, that's super important because you might even have to have the pen test performed again if you didn't set the scope correctly according to whatever compliance framework requires you to.

Ultimately, it's the client that needs to set the scope. However, Schellman can help aid in that process, we can guide you and give you our feedback on how you can get the most out of your pen test by setting the scope correctly.

If you'd like to have a conversation around scoping and start the process of kicking off your pen test assessment, go to our website, fill out our form, and myself or one of our other pen test specialists will be in touch shortly to help you in your scoping decisions. 

About Josh Tomkiel

Josh Tomkiel is a Managing Director on Schellman’s Penetration Testing Team based in the Greater Philadelphia area with over a decade of experience within the Information Security field. He has a deep background in all facets of penetration testing and works closely with all of Schellman's service lines to ensure that any penetration testing requirements are met. Having been a penetration tester himself, he knows what it takes to have a successful assessment. Additionally, Josh understands the importance of a positive client experience and takes great care to ensure that expectations are not only met but exceeded.