Gouvernance d’un programme de tests de sécurité en entreprise

Laurent Desaulniers, who runs GoSecure's penetration testing services, explains how to govern a security testing programme when budgets and talent are scarce. He starts with vocabulary: a penetration test is manual, scoped to one system and measures preventive controls only, so a vulnerability scan does not qualify; a red team is multi-vector threat emulation that also exercises detection and response; a purple team is an iterative process whose output is a list of things fixed. He describes the typical three-year client path from quick wins and patching to defence in depth to monitoring, then the questions a programme must settle: which assets when, compliance versus discovery versus risk objectives, remediation deadlines by severity approved before the test, freeze periods versus fiscal budget, and a remediation budget of two to ten times the test cost. He debunks the ideas that internal teams cannot test, that vendors must rotate yearly and that everything must be fixed, then covers hiring by promoting QA, developers and sysadmins, valuing diversity, and retaining testers through training, quality of life, research time and management support.