Why Pen Testing Is Central to State's App Security

Fortify Co-Founder and Chief Scientist Brian Chess made a stir last year when he predicted -- incorrectly, so far -- that penetration testing would be a dead art in 2009. Among those who shrugged off the suggestion was Robert Maley, CISO for the Commonwealth of Pennsylvania.

In this Q&A, Maley -- a customer of Core Security Technologies -- explains how pen testing become an essential piece of his strategy to keep citizens' personal data out of enemy hands.

Describe the environment you are responsible for.

Maley: My environment includes roughly 47 state agencies, boards and commissions, which comprises about 77,000 employees, 80,000 endpoints and 5,000 servers that my office is ultimately responsible for. We have agencies with remote offices all across the state, at least 1,000 locations.

Then there are citizens who don't work for the state but regularly access your applications to pay bills and such?

Maley: You can pay taxes, get fishing and hunting licenses, renew driver's licenses, register to vote, basically get every service the government has to offer. There has been a long-standing drive for e-government services.

Given that you're processing cardholder data online, what have you had to do to meet the demands of PCI security compliance?

Maley: We don't store cardholder data here, but we do handle the transactions that are then passed on to the bank. This is where penetration testing is important. We use internal vulnerability scanning to find and mitigate vulnerabilities before bringing in an outside vendor for additional scanning. We've had a lot of success with this approach so far.

Describe how pen testing has been woven into your core security procedures.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine