We are pleased to collaborate with you again to improve your application security so that you can seamlessly integrate with the Google ecosystem.
Google has provided new mandates for annual 2020 re-certifications. The new deadlines for expiring Google Testing Letters (LOA) are:
Google and our team highly recommend that you start the re-verification process as early as possible. All test letters must be submitted on or before the March 30, 2021 expiration date. If you wait until just before this deadline, you may end up in a scheduling queue.
More information on the Google 2020 re-verification process can be access here.
Bishop Fox was an outstanding partner for us. Under strict Google deadlines, they provided timely project quotes, reasonable prices, and excellent execution. The assessment was very well guided and communicated which made it smooth for us. The assessment was extremely helpful for our company.
Jeff Oberlander, VP of Engineering PipelineDeals
Bishox Fox collaborated with Google to design the Partner Security Program. We know what's needed for you to pass the testing requirements.
Bishop Fox was founded on the principle that all we do is advise our clients so they can make the best possible security decision.
Our Team's technical depth and expertise means we can tailor every solution or project to your unique requirements.
Partners and senior consultants drive service delivery, and we are committed to every project’s success. You won’t be handed off to a junior team.
We have negotiated discounted pricing with Google for this program, and the cost is between $10,000 and $50,000 depending on the size of the application, size of the environment, and how Google user data is utilized .
Partners will need to provide full project enablement items (e.g. credentials, test accounts, documentation, etc.) before receiving a start date. This is to ensure that there are no delays to the project schedule.
Once all the paperwork is in place, fieldwork can typically take 1 to 4 weeks. After that, reporting and QA can take up to 1 week for report delivery. This does not include remediation time.
The focus of the penetration testing will be on the external perimeter internet-facing assets and applications that store Google user data on non-Google servers, a self-assessment questionnaire, and a cloud deployment review.
Information shared with us for scoping will be used to determine overall effort required and also shorten the ramp up time needed for testing. If we can understand the environment before testing, we can spend less time on discovery/footprinting and more time and on active pen testing. The more accurate the scoping details are, the more accurate and cost sensitive we can be with the scope and quote.
We’ll leave that up to you. If you want to provide source code, it can help us be more efficient with our time and get to a deeper level of testing. That said, source code is not required for this assessment.
All sensitive data including source code will be stored, processed, and transmitted securely. Your Bishop Fox engagement manager can help setup a secure file share to use throughout the project.
Last year, we found that partners took an average of 28 days to implement fixes and complete remediation testing. Of the 28 days, about 2-3 days were used for Bishop Fox to retest the findings and issue a remediation report. This is important to note in consideration of any Google-issued deadlines.
Yes, unless Google customer data is clearly isolated from other parts of your application, we need to test the entire application. If an attacker is able to exploit one part of your application not directly related to Google, that exploit could be used to compromise Google customer data.
If it's possible to hold off (considering any deadlines given by Google), it would be best to have the most up-to-date version of your application and environment tested. This is to ensure we get appropriate coverage on any additional functionality or environment changes that could affect testing.
Yes, we will need to review the scope and determine if additional testing is required to meet our standards for a general Letter of Assessment in addition to the Google Testing Letter. If you have a particular compliance requirement, please describe it and the framework so we can consider it appropriately in scoping.
The following page explains how a partner can find the project ID and project number: https://support.google.com/googleapi/answer/7014113?hl=en