NO.
You are highly encouraged to only allow penetration testing on a staging server. Listed below are multiple reasons why you should have the penetration test done on your staging server and not production environment:
1. Minimizing Risk to Production
Running pentests on a live production server can cause unexpected downtime or disruptions, especially if the tests are invasive (e.g., vulnerability exploitation, stress tests). By using a staging server, you can ensure the live site remains operational without risk to users or customers.
2. Testing Environment Controls
A staging server replicates the production environment, which allows testers to thoroughly explore vulnerabilities without affecting the real-world data or site performance. You can configure it to match the production environment as closely as possible to get accurate results.
3. Isolation of Sensitive Data
In production, sensitive customer or internal data could be exposed to a pentester or even inadvertently altered during testing. Using a staging environment reduces the risk of exposing or corrupting such data by working with test data instead.
4. Rollback and Recovery
If something goes wrong during testing on a staging server, it’s easier to rollback, reset, or restore the environment compared to a live system.
5. Comprehensive Testing Freedom
Penetration testers may need to run intensive scans, brute-force attacks, and other tests that might trigger alarms in the live environment. A staging server gives testers the freedom to run these without worrying about live security alerts or rate-limiting protections that would interfere with their work.
Additional Considerations:
- Ensure the Staging Environment Mirrors Production: The staging environment must be an accurate representation of the production site (same codebase, configurations, server stack, etc.) to get meaningful results.
- Monitor the Staging Server: During the pentest, make sure you’re monitoring the staging environment in case there are any unexpected issues.
- Data Synchronization: Be cautious if you’re copying production data to staging. Mask or anonymize sensitive data wherever possible.
In summary, using a staging server for pentesting is a best practice because it minimizes risk to live systems while still providing a comprehensive platform for finding vulnerabilities.