Topic 1a: What is Security Testing?

Topic 1a: What is Security Testing?

1. WHY TEST?

   • ISO27001 Compliant
     • Control 12.6.1
       • Mgmt of Tech Vulns
         • "Info about technical vulns of IS being used shall be obtained in a timely fashion, the organization’s exposure to such vulns evaluated and appropriate measures taken to address the associated risk"
   • IT Governance
     • Risk
       • Assessment
       • Treatment
       • Controls
   • Compliance Reqs
     • e.g. PCI DSS

2. DEFINITIONS

   • Security Assessment
     • process of determining how effectively an entity (a.k.a assessment objs) being assessed meets specific security objectives
     • Methods
       • Testing
         • Refer to definition of Security Testing
       • Examination
       • Interviewing
   • Security Testing
     • process of exercising one or more assessment objects under specified conditions to compare actual and expected behaviors
     • Domain Specific
       • Web
       • Application
       • Software
   • Security Audit
     • Independent review and examination of records & activities to assess the adequacy of system ctrls, and ensure compliance with established policies and procedures
     • a.k.a security verification
     • usu. includes
       • pen test
       • log analysis
   • Pen Testing
     • Testing methodology in which assessors, typically working under specific constraints, attempt to circumvent the security features of an IS
     • MUST be authorized
     • Clearly defined
     • Repeatable
     • Issues arising
       • Mgmt & Methodology
         • Specific to company
       • Legal/ethical considerations
       • Tech knowledge/skills
     • Documented