How can you ensure that penetration testing is done without violating user privacy?

Transparency, proportionality, purpose limitation and data minimization. I am not a pen tester, but I'd venture out to say that most problems that could arise from a privacy perspective would be due to lack of consideration of the above principles.

I totally mis the part that you need to ensure that the pentester has the right certifications. For PEN 200 or 300. Like OSCP certification.

A pentest can be done in several ways. Black hat, Gray hat or White hat (Crystal). They all have different information before starting. It is al about security against information. I miss this part totally

When pentesting critical IT applications/ infrastructure that warehouses sensitive personal information, the tester must ensure that they maintain integrity and respecting the rights of the individuals whose data is stored there. Ultimately, this is the responsibility of the data controller who collects and uses the data and in theory, some hardening/encryption controls coupled with privacy controls such as differential privacy (adding statistical noise to the data set) can help. It takes a certain level of consideration from the pen tester and the system owner to determine what level of access and information is required to achieve the purpose.

The principle of data minimization and transparency goes in tandem with each other here. As much as possible, the pentest report should not contain any sensitive personal data that could negatively impact the rights of the individual. Anonymize such information in such a way that the vulnerability and exploitation is communicated but the personal information does not get disclosed to unauthorized parties. Before distribution, have the test results/report reviewed by privacy and security stakeholders in the organization to determine that it is safe and free for distribution.

Where data subjects information have been accessed as a result of the pentest, the organization should ensure that this is disclosed to the affected party. Update your notice to show this lawful basis for accessing the data and ensure adequate controls are in place to mitigate any privacy risks involved in penetration testing.

If you prepare and pen test internally there is also a bigger risk for the privacy. There is a direct or indirect connection between the tester and another person in the same company. Better to avoid this risk. Next to this there is a big risk that the tester will follow the IT architecture of the company instead of testing on new roads to penetrate.

Based on my experience in handling incidents and penetration testing, my perspective differs. In scenarios such as the following user privacy needs to be disregarded, and users addressed individually:. (1) Gullible whaling and spear phishing targets. (2) Those who use company email for social media. (3) Users whose email addresses have been involved in previous password leaks. (4) Users who publicly share code and other sensitive information in repositories. Confidentiality of pentest is important and please refrain from publicly naming and shaming individuals. Nevertheless, please engage with individual users e.g., to prompt the removal of sensitive data from social media platforms. Privacy does not protect users against wrongdoing.