Security Assessment and Testing

Security assessment and testing programs perform regular checks to ensure that adequate security controls are in place and that they effectively perform their assigned functions. This chapter details many of the assessment and testing controls used by security professionals around the world. It discusses the three major components of a security assessment program: security tests, security assessments, and security audits. Vulnerability assessments are some of the most important testing tools in the information security professional's toolkit. Vulnerability scans automatically probe systems, applications, and networks, looking for weaknesses that may be exploited by an attacker. Network discovery scanning uses a variety of techniques to scan a range of Internet Protocol addresses, searching for systems with open network ports. Organizations that adopt a vulnerability management system should also develop a workflow approach to managing vulnerabilities. The basic steps in this workflow should include the following: detection, validation, and remediation.