
I’ve been working on a project to introduce some new functionality into my service and wanted to check what the process was for engaging DPG for security testing.


Yep, sure! Happy to explain a little bit how it all works. The Digital Assurance team aims to ensure that all our projects ‘Go live’ securely, as well as periodically testing some of our Business-as-Usual (BAU) services, both applications and infrastructure.
Oh, right. How do I know if my service needs a security assessment?


There are a number of factors that can determine whether a security assessment is required, such as cyber-criticality and what type of information a service holds. These are explained in the Security in Application Development Standard, but the Digital Assurance team can help you understand these requirements too when you engage them.
Sure – what’s the best way to engage their services?


The best way to do this is submitting a request through Request IT
Right – and when’s the right time to engage them?


It’s never too early – the more lead time, the better, to help with the team’s planning and scheduling. Once your RequestIT ticket has been received a member of the penetration testing engagements team will reach out and begin the triage process. During this phase, they will collect information from you to assist with the scoping of your test as well as tentatively schedule testing dates.
Thanks Jamie, this is really helpful information. I will start progressing this straight-away to ensure that we stay on-schedule!

Doug and Jamie
Doug has settled into his Service Owner role at CBA and is pleased that a project to introduce some new functionality into his service is progressing well.
He has been adhering to the Security in Application Development Standard to ensure that security has been considered and implemented right from the start of his project. Doug has also adopted secure coding practices during his project, and onboarded the application to code review tools that can check for security issues.
Doug is aware that his service will need to undergo security testing before this functionality can be pushed into production. So, he reaches out to Jamie to ask how CBA manages Digital Assurance and how he can ensure this process runs as smoothly as possible.


What you can do?
Doug follows Jamie’s advice and contacts the Digital Assurance Team, to start planning for security testing for his project.
But is there anything he should do before security testing can start?


That’s right.
Scoping activities for security testing can’t commence until Doug has:
- Completed the development work - the Digital Assurance team should be testing the final product.
- Written the final solution design documentation.
- Received in-principle agreement from any impacted third-party providers that they will authorise the test to proceed on their solution.
- Checked which assessments he needs to complete as a prerequisite for testing. (Examples of assessments that may apply include a Privacy Impact Assessment (PIA) and Technology Risk Assessment (TRA) / Risk in Change or Network Impact Assessment).
- Onboarded internal developers to the application security self-assessment tools as appropriate.
Not quite.
Scoping activities for security testing can’t commence until Doug has:
- Completed the development work - the Digital Assurance team should be testing the final product.
- Written the final solution design documentation.
- Received in-principle agreement from any impacted third-party providers that they will authorise the test to proceed on their solution.
- Checked which assessments he needs to complete as a prerequisite for testing. (Examples of assessments that may apply include a Privacy Impact Assessment (PIA) and Technology Risk Assessment (TRA) / Risk in Change or Network Impact Assessment).
- Onboarded internal developers to the application security self-assessment tools as appropriate.
Delays
Doug clears all the necessary assessments and permissions so that security testing can begin. But he’s still got a few concerns.



Doug needs to submit a form through RequestIT.



Doug needs to flag it early so that the Digital Assurance team can reschedule, and testing resources can be reallocated.



The security testing team will make Doug aware of major issues as soon as possible to give him the best opportunity to remediate in a timely manner. Doug should then follow the process for findings management.



Call to action
The Digital Assurance team offers a wide variety of services to support Doug. Their value helps Doug mitigate risk and keep his project on schedule.
But Doug also needs to be realistic about the schedules associated with testing.
The typical lead time for penetration testing is 6 weeks at a minimum (from lodging a request to starting testing) for standard projects, and 4 for enterprise release engagements.
After testing, the team will need at least another 10 business days to provide a written report containing the findings, and those will take time to implement.
Select each of the following and reflect on how you can ensure timely security testing with your own projects.

Back at work
For more information, you can find security testing resources on Confluence here:
Request IT

Congratulations, you've finished Topic 5
Select the buttons below to continue.