Identity Cloud penetration testing and load testing policy
Ping Identity has a strict policy on the penetration testing and load testing of your PingOne Advanced Identity Cloud infrastructure and applications.
The policy exists for the following reasons:
- Preserves platform stability
-
The policy preserves platform stability for all Ping Identity customers.
Unscheduled testing can cause severe problems, as it can initially be indistinguishable from a real problem or a DoS attack. It can set off alarms, cause service shutdowns, add services to denylists, and prevent the support team from taking remedial actions. It can also disproportionally occupy our support team, delaying our response to other Ping Identity customers with pressing support problems.
- Regulates testing
-
The policy regulates how testing is approached so that it is realistic and manageable.
For example, a load testing plan would not be approved if it created and deleted large numbers of identities and entitlements for each test, as this is a hugely expensive operation, but not a realistic pattern of behavior.
- Avoids unnecessary testing
-
The policy helps you avoid unnecessary testing.
Ping Identity already directly tests Advanced Identity Cloud infrastructure and applications on your behalf, using code scans, penetration tests, and automated load tests. This ensures that testing is consistent and that results can be compared over time.
The penetration testing is done by a third party, in line with industry best practice. The results of the penetration testing are shared with you, with the time-consuming analysis and elimination of false positives already done by our engineers.
Policy
Policy rules
-
You are not permitted to directly test Advanced Identity Cloud infrastructure and applications. In particular, this applies to DoS or DDoS attacks. Ping Identity already does this on your behalf.
-
You are permitted to indirectly test Advanced Identity Cloud infrastructure and applications as part of a wider test of your own infrastructure and applications.
-
You are permitted to perform penetration testing and load testing only against your staging and UAT[1] environments.
-
You are permitted to perform penetration testing and load testing only up to a maximum of 2 weeks per test plan.
-
You are permitted to perform load testing only up to the license volume limits listed in the Test plan information section.
-
You are not permitted to use the built-in SMTP server as the email provider. If you have any email-dependent journeys, you must configure your own external email service as the email provider.
-
You are not permitted to perform penetration testing or load testing without Ping Identity’s prior written consent.
-
You are not permitted to authorize a third party to perform penetration testing or load testing without Ping Identity’s prior written consent.
-
To obtain Ping Identity’s prior written consent you must create a test plan and have it reviewed and approved by Ping Identity.
-
You must provide at least 2 weeks' notice of the testing start date.
Policy summary
| Development environment | Staging and UAT[1] environments | Production environment | ||||
|---|---|---|---|---|---|---|
|
|
|
Create a test plan
-
Click Create a case.
-
Follow the steps in the case submission wizard by selecting your account and contract and answering questions about your tenant environments.
-
On the Please answer the following questions to help us understand the issue you’re facing page, enter the following details, and then click Next:
Field Value What product family is experiencing the issue?
Select PingOne Advanced Identity Cloud
What specific product is experiencing the issue?
Select Configuration
What version of the product are you using?
Select NA
-
On the Tell us about the issue page, enter the following details, and then click Next:
Field Value Provide a descriptive title for your issue
Enter one of the following:
-
Submit a load testing request -
Submit a penetration testing request
Describe the issue below
Enter the following details:
-
The hostname of your staging environment
-
Within a maximum permitted duration of 2 weeks, the dates and times that you intend to do the testing.
-
-
Click Submit.
Test plan information
| Information | Description |
|---|---|
Testing strategy |
Describe the strategy you intend to follow when testing your own infrastructure and applications.
Your load testing plan should also avoid unrealistic patterns such as the setup and teardown of large numbers of identities for each load test. |
Origin of testing |
Confirm if the testing will originate from an external source over the internet or from an internal source within your Advanced Identity Cloud tenant environments. If originating from an external source, you must also supply IP addresses. |
Named contact |
Provide a named point of contact in your testing team in case Ping Identity requires the testing to be stopped due of unforeseen impacts. |
Vulnerability discovery |
Confirm that in the unlikely event that a vulnerability is discovered in Advanced Identity Cloud infrastructure or applications:
|