如何知道测试人员/供应商有资格测试我的api？
api penetration testing and web application penetration testing in general are “part art, part engineering,” which can make it hard to know what to expect and whether you got what you paid for. some questions to ask testers/vendors include: how long have you been performing api pen tests and how many have you done? have you done any with clients in my industry and/or with similar applications? what testing standards do you use as a foundation (e.g., owasp top 10, owasp asvs)? what classes of vulnerabilities will you test for? what is the experience level of the tester(s) you will use? what is your step-by-step methodology? you can also ask for a sample report.
iso 27000家族的一部分全球公认的标准，帮助组织保持数据安全。 iso 27001指定信息安全管理系统（isms）的一组“最佳实践”。这些要求涵盖政策，程序和技术控制组织可以利用以有效地管理相关风险。