Security Program Management and Oversight · Topic 6 of 7
Audits, Assessments and Penetration Testing
Security+ audits: sampling, assertions, ATT&CK and Kill Chain, audit charter, internal and external reviews, benchmarking and penetration test types.
- 5 min
- Sampling tests a subset. An assertion is management's claim that the auditor verifies.
- ATT&CK lists techniques, the Kill Chain lists attack stages and the Diamond Model links adversary, capability, infrastructure and victim.
- The audit charter gives the audit function its authority and scope.
What it is
Audits and assessments check whether controls exist and work. An audit compares practice against a standard or rule, an assessment evaluates strength and risk, and a penetration test tries to break in, with permission, to show real impact.
The exam asks how evidence is gathered, how an audit is scoped, who performs the check and how much a tester knows in advance.
How it works
Data gathering
| Method | Meaning |
|---|---|
| Sampling | Testing a representative subset, such as 25 of 2,000 access requests, instead of every record |
| Questionnaires or surveys | Written questions sent to staff or vendors, quick but self reported |
| Interviews | Talking with control owners to understand how a process really runs |
| Assertion | A claim by management that a control is in place and working, which the auditor then tests |
Reference sources give a common language for threats when assessing defenses.
| Reference | What it is |
|---|---|
| MITRE ATT&CK | A knowledge base of adversary tactics and techniques based on real world observations |
| Cyber Kill Chain | Lockheed Martin's seven stages of an attack, from reconnaissance to actions on objectives |
| Diamond Model of Intrusion Analysis | Links four features of an intrusion: adversary, capability, infrastructure and victim |
An assessor can map existing controls to ATT&CK techniques to show which attacker behaviors would go undetected.
Scoping
An audit charter is the formal document that sets the audit function's purpose, authority and responsibilities, including its right to access records and staff. Frequency sets how often audits run, such as yearly, quarterly or after major changes, often driven by regulation or risk.
Engagement types
| Type | Description |
|---|---|
| Gap analysis | Compares the current state with a target standard to list what is missing |
| Internal: compliance | Staff check that the organization meets laws, standards and policy |
| Internal: audit committee | A board level group that oversees audits and holds management to account |
| Internal: self-assessments | Teams evaluate their own area against a checklist or standard |
| External: examinations | Formal reviews by an outside authority |
| External: assessments | Outside experts evaluate security posture or risk |
| External: regulatory | Reviews by a regulator to check legal compliance |
| External: independent third-party audits | An outside firm with no stake in the result gives an objective opinion |
| Benchmarking | Comparing practices or results with peers or with an accepted standard |
Internal work is cheaper and more frequent but less independent. External reviews carry more weight with regulators and customers.
Frameworks and standards
| Type | Example |
|---|---|
| Industry-based standards | The Payment Card Industry Data Security Standard (PCI DSS) for card data |
| International standards | ISO/IEC 27001 for an information security management system |
| Region-specific standards | Rules for one country or region, such as NIST publications for US federal systems |
Functional and behavioral testing
Functional testing checks that a control does what it was designed to do, such as confirming that an account locks after the set number of failed logins. Behavioral testing checks how people actually act, such as a simulated phishing email or an attempt to tailgate through a door.
Penetration testing
| Type | Meaning |
|---|---|
| Known environment | Tester has full information, such as diagrams and credentials |
| Partially known environment | Tester has some information |
| Unknown environment | Tester starts with little or nothing, like an outside attacker |
| Physical | Tests locks, doors, badges and guards |
| Offensive | Simulates an attacker, often called the red team |
| Defensive | Focuses on detection and response, often called the blue team |
| Integrated | Offensive and defensive teams work together and share findings |
Reconnaissance comes first. Passive reconnaissance uses public sources and never touches the target, while active reconnaissance, such as port scanning, sends traffic to it and can be detected.
How the exam asks about this
- "The auditor checks 30 randomly chosen change tickets from the past year." -> Sampling.
- "The tester receives network diagrams and admin credentials before starting." -> A known environment test.
- "The team compares its controls with ISO/IEC 27001 to list what is missing." -> A gap analysis.
What to remember for the exam
- Sampling tests a subset. An assertion is management's claim that the auditor verifies.
- ATT&CK lists techniques, the Kill Chain lists attack stages and the Diamond Model links adversary, capability, infrastructure and victim.
- The audit charter gives the audit function its authority and scope.
- Independent third-party audits are the most objective.
- Gap analysis lists what is missing against a target. Benchmarking compares with peers or a standard.
- Functional testing checks controls. Behavioral testing checks people.
- Known, partially known and unknown environments describe how much the tester knows.
- Passive reconnaissance does not touch the target. Active reconnaissance does.
When a question says the tester has full documentation and credentials, the test is in a known environment.
Common mistakes
Confusing a vulnerability scan with a penetration test. A scan lists possible flaws. A penetration test tries to exploit them.
Accepting an assertion as proof. Management's claim must be tested with evidence.
Assuming internal audits are as objective as external ones. Internal staff may lack independence.
Mixing up red and blue teams. Red attacks, and blue defends.
Testing without authorization. Written approval and rules of engagement come first.
Check yourself
What is an assertion in an audit?
A claim by management that a control is in place and working, which the auditor then tests.
What does an audit charter establish?
The audit function's purpose, authority and responsibilities.
What distinguishes passive from active reconnaissance?
Passive reconnaissance uses public sources without touching the target, while active reconnaissance sends traffic to it.
Topic 6 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.