Include the identity provider and the customer VPN gateway in the next pentest scope
Description
The penetration test covered the external and internal network, but the identity provider and the customer VPN gateway were only partly in scope. Both systems sit on the path of every customer connection, and the tester suggested testing them in depth next time. Adding them to the scope of the next test costs little and follows directly from the Risk assessment.
Summary
On trackThis workflow is complete.
Completed
on
by Sam de Vries
The scope of the next penetration test now lists the identity provider and the customer VPN gateway as in-depth targets, and the rules of engagement were updated to match.