SecTemplates.com

I have built out several penetration testing programs, both internally and externally at companies such as eBay, Paypal, and Box to name a few. Before you have the resources for an internal penetration testing program, you're going to need to work with external vendors to perform your testing. This release pack outlines the process I have used successfully, for more than a decade, for kicking off and managing an external pentest.

Robert Auger (@robertauger)

External Penetration Testing Program Release Pack 1.0

I'm pleased to announce our second release, the External Penetration Testing Program release pack. This release contains everything you need to scope your first pentest, work with a vendor, execute, and get the types of reports you need from an external tester. This will enable you to perform your first product or infrastructure level penetration test, and provide you with a process moving forward for future engagements.

In this pack, we cover:
Preparation Checklist: This checklist outlines everything you need to scope and perform an external penetration test with a third party.
Penetration Testing Reporting Requirements: This document provides a list of minimal requirements that should be contained within a penetration testing report. Before finalizing a SOW with the vendor, look here first.
Penetration Testing Process Workflow: An outline of a simplified pentesting process with an external tester. It aligns roughly with the content in the penetration testing checklist.

https://github.com/securitytemplates/sectemplates/tree/main/external-penetration-testing

To provide simplified, free, and usable open-source templates to enable engineering and smaller security teams to bootstrap security capabilities in their organizations.

Our bug bounty release pack will provide you with everything you'd need to establish a bugbounty program. This includes working with a vendor, establishing a private bug bounty, and ultimately moving to a public bug bounty. This release pack is not sponsored, or influenced by any particular bug bounty vendor and is neutral to vendor biases and influence.

The goal of this release is to provide you with everything you need to establish a functioning security incident response program at your company.

Download on GitHub: https://github.com/securitytemplates/sectemplates/tree/main/external-penetration-testing/v1 

I'm pleased to announce our first release, the Incident Response Program Pack. The goal of this release is to provide you with everything you need to establish a functioning security incident response program at your company.

In this pack, we cover

• Definitions: This document introduces sample terminology and roles during an incident, the various stakeholders who may need to be involved in supporting an incident, and sample incident severity rankings.
• Preparation Checklist: This checklist provides every step required to research, pilot, test, and roll out a functioning incident response program.
• Runbook: This runbook outlines the process a security team can use to ensure the right steps are followed during an incident, in a consistent manner.
• Process workflow: We provide a diagram outlining the steps to follow during an incident.
• Document Templates: Usable templates for tracking an incident and performing postmortems after one has concluded.
• Metrics: Starting metrics to measure an incident response program.

Download on GitHub:
https://github.com/securitytemplates/sectemplates/tree/main/incident-response/v1

Licensing
This project utilizes a modified creative commons license.

About SecTemplates
To provide simplified, free, and usable open-source templates to enable engineering and smaller security teams to bootstrap security capabilities in their organizations.