Choosing the right work.
WHAT TO ESTABLISH FIRST
Why you are doing it.
WHAT THE USUAL REASONS ARE
A customer or contract requires it A regulator or standard requires it Before launching something new After significant change Periodic assurance Following an incident
WHY THE REASON MATTERS
It determines scope, depth and what the report must demonstrate.
WHAT TO ESTABLISH
What is most at risk.
WHAT THAT DEPENDS ON
What data you hold What systems are exposed externally What would cause most harm if compromised Where you have least confidence
WHAT TO PRIORITISE
Anything reachable from the internet Anything holding sensitive data Anything recently built or changed
WHY INTERNET-FACING FIRST
It is reachable by everyone, continuously.
WHAT SCANNING SUITS
Regular identification of known vulnerabilities across many systems.
WHAT TESTING SUITS
Establishing whether weaknesses can actually be exploited, and what could be reached.
WHAT CODE REVIEW SUITS
Finding issues in software you build, before deployment.
WHAT CONFIGURATION REVIEW SUITS
Systems where misconfiguration is the likely weakness.
WHY THAT MATTERS
Most compromises exploit configuration and known unpatched issues rather than novel vulnerabilities.
WHAT TO ESTABLISH
Whether basic measures are in place first.
WHY BEFORE TESTING
Testing a system with obvious unaddressed weaknesses produces a report of things you already knew.
WHAT TO DO FIRST
Patch, remove default credentials, restrict access, enable authentication.
WHY
It makes the assessment worth its cost.
