Preparing for security, penetration or load testing

If you're going to perform a security scan, penetration testing or load testing on your website, the Acquia Support team needs some specific pieces of information to help to ensure the success of your tests and prevent website outages. For information specific to load testing, see Load and stress testing.

Important

If your testing includes elevated traffic levels, penetration testing will require dedicated hardware. This prevents potential outages for websites sharing the server that is undergoing testing.

What Acquia needs to know

The Acquia Support team needs to know the following:

• Exact start and end dates and times (including timezone) of the planned testing
• Originating IP addresses conducting the testing (please list individual IPs, NOT IP ranges)
• Expected methodologies and specific tools to be used in the process of the security testing
• Contact information for any third party that is conducting the testing (if being done by a third party)
• Peak bandwidth in Gigabits per second (Gpbs)

After you've collected this information, open a ticket with the Support team that includes this information. The Support team will then engage other teams to prepare for your tests as necessary.

Create the ticket to notify the Support team at least two business days in advance of your testing.

Note

If you start a test without notifying the Support team and the test generates sufficient load, the Acquia Cloud platform will treat the test as a presumed attack or traffic related issue and may block it. You will then be asked to make arrangements to put a dedicated test balancer and/or a separate mirror of your production environment in place for the test. As noted, this takes at least two business days to arrange.