Security Program Management and Oversight · Topic 6 of 7
Audits, Assessments and Penetration Testing
Security+ audits and assessments: attestation, internal and external reviews, penetration test types, known and unknown environments, red and blue teams.
- 4 min
- Attestation is a formal confirmation that controls or statements are accurate.
- Internal assessments include compliance checks, audit committee oversight and self assessments.
- External assessments include regulatory examinations and independent third party audits.
What it is
Audits and assessments check whether controls exist and work. An audit compares practice against a standard or rule, and an assessment evaluates strength and risk. Penetration testing goes further by trying to break in, with permission, to show real impact.
The exam asks who performs the check, how independent they are and how much the tester knows in advance.
How it works
Attestation
Attestation is a formal statement by a qualified party that controls or claims are accurate. An auditor may attest that a system meets a standard, or a manager may attest that a process was followed. Attestation is the output that others rely on.
Internal assessments
| Type | Description |
|---|---|
| Compliance checks | Review whether the organization meets laws, standards and policy |
| Audit committee | A board level group that oversees audits and holds management to account |
| Self assessments | Teams evaluate themselves against a checklist or standard |
Internal work is cheaper and frequent, but it is less independent. Staff may overlook weaknesses in their own area.
External assessments
| Type | Description |
|---|---|
| Regulatory | Examination by a government or industry regulator |
| Examinations | Formal reviews by authorities or customers |
| Independent third party audit | An outside firm assesses the controls and gives an objective opinion |
External reviews carry more weight with regulators, customers and partners because the assessor has no stake in the result.
Penetration testing
A penetration test is an authorized simulated attack to find weaknesses and show their impact. It needs written approval, a defined scope and rules of engagement.
| Type | Meaning |
|---|---|
| Physical | Tests locks, doors and other physical barriers |
| Offensive | Simulates an attacker, often called the red team |
| Defensive | Focuses on detection and response, often called the blue team |
| Integrated | Red and blue teams work together and share what they learn |
Knowledge of the environment
| Type | What the tester knows |
|---|---|
| Known environment | Full information, as if an insider (often called white box) |
| Partially known environment | Some information (gray box) |
| Unknown environment | Little or nothing, as an outsider would (black box) |
A known environment test is thorough and efficient, because testers do not spend time discovering what the customer could simply provide. An unknown environment test is closer to a real outside attack but takes longer.
Reconnaissance
Reconnaissance is gathering information about a target. Passive reconnaissance uses public sources and does not touch the target's systems. Active reconnaissance sends traffic to the target, such as scanning, and can be detected.
Reporting
A good report states what was tested, what was found, how serious each finding is and how to fix it. Findings feed the risk register and remediation plans.
What to remember for the exam
- Attestation is a formal confirmation that controls or statements are accurate.
- Internal assessments include compliance checks, audit committee oversight and self assessments.
- External assessments include regulatory examinations and independent third party audits.
- Independent third party audits are the most objective.
- A penetration test needs written authorization, a scope and rules of engagement.
- Offensive testing is the red team, defensive is the blue team, and integrated combines them.
- Known, partially known and unknown environments match white, gray and black box testing.
- Passive reconnaissance does not touch the target. Active reconnaissance does.
When a question says the tester has full documentation and credentials, the test is performed in a known environment.
Common mistakes
Confusing a vulnerability scan with a penetration test. A scan lists possible flaws. A penetration test tries to exploit them to show impact.
Assuming internal audits are as objective as external ones. Internal staff may lack independence.
Testing without authorization. Without written approval and rules of engagement, testing can be illegal.
Mixing up red and blue teams. Red attacks, and blue defends.
Thinking passive reconnaissance is risk free for the tester. It does not touch the target, but it still needs to stay within scope and the law.
A penetration test report contains the weak points of the organization. Protect it as sensitive information and share it only with those who need it.
Check yourself
What makes an independent third party audit valuable?
The assessor has no stake in the result, so the opinion is objective.
What is the difference between a known and an unknown environment test?
In a known environment the tester has full information, while in an unknown environment the tester starts with little or nothing.
What distinguishes passive from active reconnaissance?
Passive reconnaissance uses public sources without touching the target, while active reconnaissance sends traffic to the target.
Topic 6 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.