Your vendor should be guarding against intrusion into the systems network from the outside and conducting regular penetration testing through a qualified credible resource.
You should insure that penetration testing is being performed on any vendor who has access to or stores your consumer private information or sensitive data.
When a vendor runs a penetration test their goal is to identify vulnerabilities in their hardware, software and overall network.
While there isn’t really guidance to the appropriate frequency, we suggest once annually, at a minimum, for vendors who store sensitive data.
Examples of exceptions where an additional penetration test should be re-run include:
If you receive the high level summary from your vendor and it has some critical or high risk vulnerabilities listed on it, your vendor should be responding with "here is what we have done to fix it" or "here's what we are going to do to fix it and this is the timeline" and "here’s a new penetration test result that shows that the issue has been resolved".
Don’t discuss the issues by email – have a conversation one-on-one on the phone with your vendor and if needed, have them put people on the phone that can explain to you what those issues are. It’s less important that the results of a penetration test are clean than it is that your vendor addresses any high or moderate risk threats quickly and efficiently either with a fix or explanation as to why it has to be the way it is.
You don’t need to receive your vendor’s vendors penetration testing results. What you do need is make sure that YOUR vendor has a proper vendor management policy that is actively being executed upon by the vendor. The way that you know that is you
Also, be sure you have a list of your vendor’s critical vendors. So, if your vendor is extremely reliant on 3 vendors – you need to know who those are and what they do for the vendor. Reason being, if you see a headline in the news about one of those three, you need to know that it could affect you and because they’re not your actual vendors you may or may not even know their names or that they could have an effect on you.
So at a bare minimum you need to know that your vendor has a good vendor management program in place which should include all the things that you’re doing for your own vendors. Just like your own vendor management program is tested by your auditors and examiners, you should be able to see that your vendor’s vendor management program is being audited and tested in some way.
While penetration tests can be automated with tools that are basically programmed to run and look for certain things in your vendor's network, it is prudent and recommended for the vendor to go above and beyond by putting a professional ethical hacker to work to try to attempt to compromise the network outside of what that automated tool is doing.
If a vendor is doing both those things through a qualified and reputable source, they get an A+ for effort. They’re taking it seriously and you should feel really good about that. The only questions then are on the frequency, and of course, the resolution of issues identified by this testing.
If your vendor is not doing network penetration testing, you might want to put some pressure on them to implement a penetration testing policy that commits them to the types and frequency of the tests.
Be sure to get their commitment on when the first test will be conducted and (executive summary level) results made available to you. OR, if they won’t do that then you may want to consider asking for permission to run your own penetration test.
Now, understand it’s really not feasible for a vendor to commit to let all their clients run a pen test against their network – in fact, I would be weary of a vendor that allows you to do that over them actually committing to do their own tests. In other words, the fact that they will not commit to perform testing but will allow you to test against their network may indicate a deeper issue with your vendor.