A Penetration Test is an attack on a computer system from inside or outside, agreed with the owner.

The SANS20 is a list of 20 checks used to test the security level of an IT infrastructure. This methodology, devised by the SANS Institute, active since 1989 in the field of Cybersecurity, is expressly referred to in AGID (Agenzia per l’Italia Digitale) Circular No. 2/2017 on the subject of minimum ICT security measures for PA.

The analysis of computer devices within a civil or criminal trial is a rather new set of methods and techniques in Italian law. It originated as “Computer Forensics”, as digital evidence was until ten years ago only contained within hard disks; today we speak of “Digital Forensics” because the devices to be analysed include not only PCs but also card memories, telephones, smartphones, tablets, GPS, etc.

It is mandatory to notify within 72 hours the breach of one’s computer system to the Privacy Authority, describing what data has been stolen and reporting the possible consequences for consumers. Together with the notification, the security measures taken and those that will be taken after the breach to remedy the situation must be described. Given the tight timeframe and the amount of the sanctions (up to 4 per cent of turnover), it is advisable to have first prepared a description of the minimum security measures and a contingency plan for Data Breach cases.