Sooner or later a customer, a partner or an insurer asks for evidence that your systems have been independently tested. For many smaller software and service companies, the first answer is an external security test. It is worth knowing what that is before you commission one.
What it is
The tester looks at your systems from the public internet, as a stranger would. They identify every address and service you expose, check which ports answer, and scan what they find against the public catalog of known vulnerabilities. A good test is run twice: once as an anonymous outsider, and once from an address your firewall trusts, the way a customer would connect.
What you should receive
- The scope: exactly what was tested, and on what date.
- The method, described so a non-specialist can follow it.
- The findings, with anything that needs attention ranked by seriousness.
- A statement of what was outside the test.
What it does not cover
- The cloud provider’s own infrastructure. You cannot test a provider’s data centers. They publish their own audit reports, and your report should point to them.
- The inside of your network, and what a signed-in user could do.
- Your application’s logic. That is a deeper and more expensive penetration test.
- People. Phishing and weak passwords remain the most common way in.
How often
Once a year is a reasonable minimum, and again after any significant change to what you expose. The value is in the routine: a dated report you can hand to anyone who asks, and a list of findings that gets shorter each time.
Related service: IT security & penetration testing.