Identity Cloud penetration testing and load testing policy

Ping Identity has a strict policy on the penetration testing and load testing of your PingOne Advanced Identity Cloud infrastructure and applications.

The policy exists for the following reasons:

Preserves platform stability: The policy preserves platform stability for all Ping Identity customers.

Unscheduled testing can cause severe problems, as it can initially be indistinguishable from a real problem or a DoS attack. It can set off alarms, cause service shutdowns, add services to denylists, and prevent the support team from taking remedial actions. It can also disproportionally occupy our support team, delaying our response to other Ping Identity customers with pressing support problems.
Regulates testing: The policy regulates how testing is approached so that it is realistic and manageable.

For example, a load testing plan would not be approved if it created and deleted large numbers of identities and entitlements for each test, as this is a hugely expensive operation, but not a realistic pattern of behavior.
Avoids unnecessary testing: The policy helps you avoid unnecessary testing.

Ping Identity already directly tests Advanced Identity Cloud infrastructure and applications on your behalf, using code scans, penetration tests, and automated load tests. This ensures that testing is consistent and that results can be compared over time.

The penetration testing is done by a third party, in line with industry best practice. The results of the penetration testing are shared with you, with the time-consuming analysis and elimination of false positives already done by our engineers.

Policy

Policy rules

You are not permitted to directly test Advanced Identity Cloud infrastructure and applications. In particular, this applies to DoS or DDoS attacks. Ping Identity already does this on your behalf.
You are permitted to indirectly test Advanced Identity Cloud infrastructure and applications as part of a wider test of your own infrastructure and applications.
You are permitted to perform penetration testing and load testing only against your staging and UAT^[1] environments.
You are permitted to perform penetration testing and load testing only up to a maximum of 2 weeks per test plan.
You are permitted to perform load testing only up to the license volume limits listed in the Test plan information section.
You are not permitted to use the built-in SMTP server as the email provider. If you have any email-dependent journeys, you must configure your own external email service as the email provider.
You are not permitted to perform penetration testing or load testing without Ping Identity’s prior written consent.
You are not permitted to authorize a third party to perform penetration testing or load testing without Ping Identity’s prior written consent.
To obtain Ping Identity’s prior written consent you must create a test plan and have it reviewed and approved by Ping Identity.
You must provide at least 2 weeks' notice of the testing start date.

Policy summary

Development environment

Staging and UAT^[1] environments

Production environment

No penetration testing or load testing permitted

Indirect penetration testing and load testing permitted as part of a wider test of your own infrastructure and applications
DoS or DDoS attacks not permitted
Load testing permitted only up to your license volume limits
Penetration testing and load testing permitted only up to a maximum of two weeks per test plan
Use of built-in SMTP server not permitted for testing
Penetration testing and load testing only permitted with Ping Identity’s prior written consent, an approved test plan, and at least two weeks' notice

No penetration testing or load testing permitted

Create a test plan

Open an Advanced Identity Cloud: Config request with Backstage Support.

On the Advanced Identity Cloud: Config Request page, provide the following information:

Field	Value
Hostname	Enter the hostname of your staging environment.
What would you like to do?	Choose one of the following: Submit a load testing request Submit a penetration testing request
Describe your test scenario	Enter Test plan information.
What is your testing schedule?	Within a maximum permitted duration of 2 weeks, provide the dates and times that you intend to do the testing.

Field

Value

Hostname

Enter the hostname of your staging environment.

What would you like to do?

Choose one of the following:

Submit a load testing request
Submit a penetration testing request

Describe your test scenario

Enter Test plan information.

What is your testing schedule?

Within a maximum permitted duration of 2 weeks, provide the dates and times that you intend to do the testing.

Ignore the remaining form fields.
Click Submit to create the support ticket.

Test plan information

Information	Description
Testing strategy	Describe the strategy you intend to follow when testing your own infrastructure and applications. For load testing plans, indicate the number of identities you intend to create, and the throughput levels you intend to simulate. These should be in line with the number of identities and throughput agreed with Ping Identity when your Advanced Identity Cloud service was provisioned, and not go above the following thresholds: Agreed number of identities +25% Agreed throughput +50% Your load testing plan should also avoid unrealistic patterns such as the setup and teardown of large numbers of identities for each load test.
Origin of testing	Confirm if the testing will originate from an external source over the internet or from an internal source within your Advanced Identity Cloud tenant environments. If originating from an external source, you must also supply IP addresses.
Named contact	Provide a named point of contact in your testing team in case Ping Identity requires the testing to be stopped due of unforeseen impacts.
Vulnerability discovery	Confirm that in the unlikely event that a vulnerability is discovered in Advanced Identity Cloud infrastructure or applications: That the vulnerability will be tested no further than the point of discovery That a description of the vulnerability will be promptly and responsibly disclosed to Ping Identity

Information

Description

Testing strategy

Describe the strategy you intend to follow when testing your own infrastructure and applications.

For load testing plans, indicate the number of identities you intend to create, and the throughput levels you intend to simulate. These should be in line with the number of identities and throughput agreed with Ping Identity when your Advanced Identity Cloud service was provisioned, and not go above the following thresholds:

Agreed number of identities +25%
Agreed throughput +50%

Your load testing plan should also avoid unrealistic patterns such as the setup and teardown of large numbers of identities for each load test.

Origin of testing

Confirm if the testing will originate from an external source over the internet or from an internal source within your Advanced Identity Cloud tenant environments. If originating from an external source, you must also supply IP addresses.

Named contact

Provide a named point of contact in your testing team in case Ping Identity requires the testing to be stopped due of unforeseen impacts.

Vulnerability discovery

Confirm that in the unlikely event that a vulnerability is discovered in Advanced Identity Cloud infrastructure or applications:

That the vulnerability will be tested no further than the point of discovery
That a description of the vulnerability will be promptly and responsibly disclosed to Ping Identity

1. A user acceptance testing (UAT) environment is an add-on capability.