Now with your initial organization setup, we’ll go into more detail on how to fully configure the organization for a continuous penetrating test. Returning to the toggles during the initial setup, here is more information about what they represent.

• Enabled - This toggle enables the organization and allows it to be displayed in the assignment menu.

• Ongoing - This toggle enables services to run, like host service and web application discovery, vulnerability scans, and more. It signifies that the client is actively being worked on.

• Run Score Card - This toggle enables the score card feature to run, but it works best when combined with EDR integration. Without EDR integration, the score call will assume all systems do not have endpoint protection and you clients will receive an F grade for endpoint protection.

• Infrastructure Integration - This toggle allows the Networks tab under Assets to be populated.

• Source Code Integration - This toggle allows the Source Code tab to be displayed under Assets.

• DAST Integration - This toggle allows the Web Application tab to be displayed under Assets.

• Cloud Integration - This toggle enables the ability to integrate with cloud environments and displays the Cloud VM's and PaaS tabs.

To complete the organization setup, you have to add locations, and inside each Location, you need to add Zones. Below is a high-level overview of locations with multiple zones.

The first Location we will create is our QTS Data Center. Browse to Organization > Locations, and then click the Add button.

Give the Location a name, and choose the Location type. Location types are Physical, AWS, and Azure. For our physical data center, we will choose Physical. Fill out the address details then click Submit. We will discuss the Cloud Integration Options in a different section.

Now we can setup Zones. The first Zone will be the PUBLIC internet zone.

Your configuration options are as follows:

• Name

• Location

• Scanner Group (we will choose CLOUD_SG for our public zones)

• IP Scope

• IP Exclusions

• URL Scope

• Host Discovery Frequency

• Host Discovery Parameters

• Port Scan Frequency

• Port Scan Parameters

• Max hosts per port scan

• Port Scan black out times

• Web Discovery Frequency

• Web Analysis Frequency

• SMB Discovery Frequency

• In-flight Encryption Discovery Frequency

• GVM Scan Configuration

• GVM scan Frequency

• Vulnerability Scan black out times

• OWASP ZAP Scan Frequency

• OWASP ZAP scan black out times

• Is this a Public facing Zone?