Facebook partner security assessment service page header

SUPPORTING FACEBOOK WORKPLACE PARTNERS
AND CUSTOMER SECURITY

The Workplace Partner Security Program is a collaborative effort to protect Workplace partners, their customers, and Workplace's data by increasing the security of applications that integrate with the Workplace ecosystems. All applications that use one or more medium - or high-sensitivity permissions are required to undergo security review.

Workplace has engaged Bishop Fox to conduct appropriate security testing with the goal of validating the security of Workplace partners’ applications and ensuring Workplace user data is being handled securely.

Bishop Fox’s primary goal is to help you complete the Security Assessment requirements listed on:
Facebook for Developers - Pass Security Review

The security assessment includes two parts:

  1. Application Penetration Testing 
  2. Security RFI - We will evaluate the effectiveness of the independent software vendor's security practices and procedures across a breath of areas, including data handling, secure software development, and vulnerability management.

Passing the security review is required before your app can be used by any Workplace customers and is then required annually thereafter.

Learn more about how Bishop Fox helps you validate the security of your application in our What to Expect guide.

      
Bishop Fox was an outstanding partner for us. Under strict deadlines, they provided timely project quotes, reasonable prices, and excellent execution. The assessment was very well guided and communicated which made it smooth for us.  The assessment was extremely helpful for our company.

 

Jeff Oberlander, VP of Engineering PipelineDeals

PARTNERSHIPS

Bishop Fox was selected by Facebook  to work with their Workplace Partner Security Program. We know what's needed for you to pass the testing requirements.

WE DO ONE THING

Bishop Fox was founded on the principle that all we do is advise our clients so they can make the best possible security decision.

DEEP EXPERIENCE

Our Team's technical depth and expertise means we can tailor every solution or project to your unique requirements.

SENIOR ATTENTION

Senior consultants drive service delivery, and we are committed to every project’s success. You won’t be handed off to a junior team.

Get In Touch

FAQs

HOW MUCH WILL THE ASSESSMENT COST?

Cost estimate will depend on the size of the application, size of the environment, and the sensitivity permissions (medium or high) used by the app.

WHEN WILL THE ASSESSMENT START?

ISV's will need to provide full project enablement items (e.g. access to a test environment that mirrors prod, credentials, test accounts, documentation, etc.) before receiving a start date. This is to ensure that there are no delays to the project schedule.

HOW LONG WILL THE ASSESSMENT TAKE?

Once all the paperwork is in place, fieldwork can typically take 1 to 2 weeks. After that, reporting and QA can take up to 1 week for report delivery. This does not include remediation time.

WHAT WILL THE SCOPE OF THE TESTING BE?

The focus of the penetration testing will be on:

  1. Application Penetration Testing 
  2. Security RFI - We will evaluate the effectiveness of the ISV's security practices and procedures across a breath of areas, including data handling, secure software development, and vulnerability management.
WHAT WILL THE SCOPING INFORMATION BE USED FOR?

Information shared with us for scoping will be used to determine overall effort required and also shorten the ramp up time needed for testing. If we can understand the environment before testing, we can spend less time on discovery/footprinting and more time and on active pen testing. The more accurate the scoping details are, the more accurate and cost sensitive we can be with the scope and quote.

DO I NEED TO PROVIDE SOURCE CODE?

We’ll leave that up to you. If you want to provide source code, it can help us be more efficient with our time and get to a deeper level of testing. That said, source code is not required for this assessment.

HOW WILL MY SENSITIVE DATA BE HANDLED?

All sensitive data including source code will be stored, processed, and transmitted securely. Your Bishop Fox engagement manager can help setup a secure file share to use throughout the project.

HOW LONG DOES REMEDIATION TAKE?

Typically, about 1-2 weeks for remediation testing depending on size of remediation testing.

WE ARE INTERESTED IN A STANDARD LETTER OF ASSESSMENT IN ADDITION TO THE WORKPLACE TESTING LETTER. DOES THIS CHANGE THE SCOPE/COST?

Yes, we will need to review the scope and determine if additional testing is required to meet our standards for a general Letter of Assessment in addition to the Workplace Testing Letter. If you have a particular compliance requirement, please describe it and the framework so we can consider it appropriately in scoping.


STILL HAVE QUESTIONS?

Chat with one of our security experts to learn how we can support your security needs.

CONTACT US