Internal Assessments

Program managers must understand why it's necessary to have a working understanding of penetration testing and the associated vulnerability assessment phases. This chapter introduces some useful crash‐course assessment concepts and tooling. Program managers should perform full internal assessments before opening the program, even to a small group of security researchers. One of the most important aspects of internal testing is to place oneself in the shoes of a threat actor. An active assessment is one in which a hacker tests for vulnerabilities. One of the best tools in a program manager's arsenal for testing URL parameters and finding hidden parameters is DalFox. Program managers should aspire to learn as much as possible to identify a wider range of bugs. For program managers that don't have the experience to perform internal assessments themselves, they should outsource to a trusted penetration testing firm and ask for a blackbox test.