How to Set Your Penetration Test Scope | Schellman

Setting the scope correctly is the number one thing you need to worry about when you're starting the process of choosing a pen test provider.

Why does everyone harp on scoping with timing and pricing??

Hi, I'm Josh Tomkiel, I'm a senior manager here at Schellman on the pen test team. I've been in the industry for over 10 years, started off as a penetration tester working on web applications and internal and external networks. And now I'm on the manager side overseeing projects.

So you've decided you're going to have a penetration test performed, you're going out talking to vendors, getting estimates. But the first thing that everybody asks you: "what's the scope? What's the scope?" Why is it so important? It's important because the scope dictates:

• how long the engagement is going to take
• how many resources or pen testers need to be assigned to your project in order to give you a quality deliverable?
• How many applications?
• How big are the applications?
• Do the web apps have multiple features?
• Are there different roles, user types, and permission levels?

So it takes a very long time. Automated tools are included when performing a pen test, but 90% of it is very manual, especially on the web app side, where we're processing each request from the application, tampering with it in most cases, and seeing what the underlying server does.

If you don't set the scope correctly, two things can happen.

1. You won't get the most value from your pen test. You'll get a false sense of security. Oh, I only have one web application in scope and you guys didn't get credit credentials, so you can't even log in. Oh, good. The pen test report says no findings to report. All right. Nothing else to do here. But that's not very good because the scope was not set accurately. We got to log in. We got to see what's there. We've got to assess the application from an authenticated perspective to get the most understanding of the overall attack surface. Same thing with networks or mobile apps. If you exclude certain hosts from the scope, you won't get the complete picture and value that a pen test can provide.
2. Now, if there's a compliance initiative, that's super important because you might even have to have the pen test performed again if you didn't set the scope correctly according to whatever compliance framework requires you to.

Ultimately, it's the client that needs to set the scope. However, Schellman can help aid in that process, we can guide you and give you our feedback on how you can get the most out of your pen test by setting the scope correctly.

If you'd like to have a conversation around scoping and start the process of kicking off your pen test assessment, go to our website, fill out our form, and myself or one of our other pen test specialists will be in touch shortly to help you in your scoping decisions.