Security Assessment and Testing · Topic 2 of 3
Security Control Testing
Vulnerability assessment and penetration testing, log reviews, synthetic transactions, code review, misuse cases, coverage, interface testing and breach simulation.
- 3 min
- Scans find; penetration tests prove; code review finds flaws in source.
- Authenticated scans are more accurate.
- Black, gray and white box describe tester knowledge.
What it is
Security control testing checks whether controls actually work. Each test method answers a different question, so a sound program combines several. The exam describes a goal and asks which test fits.
How it works
Test methods
| Method | What it shows | Blind spot |
|---|---|---|
| Vulnerability assessment | Known weaknesses across many systems | Whether weaknesses can be chained into a breach |
| Penetration testing | Whether an attacker can achieve a goal | Coverage of every weakness; time-boxed sample |
| Log reviews | Whether events are recorded and suspicious activity noticed | Events never logged |
| Synthetic transactions | Scripted transactions that test availability and function | Real user behaviour |
| Real user monitoring | How real users experience the service | Paths users never take |
| Code review and testing | Flaws in source code (manual review, SAST) | Runtime and configuration issues |
| Misuse case testing | How the system handles abuse scenarios | Scenarios nobody imagined |
| Test coverage analysis | How much code or requirements tests exercise | Quality of the tests themselves |
| Interface testing | APIs, user interfaces and physical interfaces behave securely | Internal logic |
| Breach and attack simulation | Automated, repeatable attack techniques to validate defenses | Novel attacker creativity |
| Compliance checks | Configurations match the required baseline | Flaws the baseline does not describe |
Vulnerability scanning
- Authenticated (credentialed) scans see more and produce fewer false positives than unauthenticated scans.
- Rate findings with a scoring system such as CVSS, then prioritize by the asset's importance and exposure.
- Short-lived systems such as containers are better covered by scanning images in the registry and pipeline than by periodic host scans.
Penetration testing
| Knowledge level | Meaning |
|---|---|
| Black box (zero knowledge) | Tester starts with no inside information |
| Gray box (partial knowledge) | Some information, like a typical insider or contractor |
| White box (full knowledge) | Full documentation and access; most thorough |
Typical phases: planning and rules of engagement, reconnaissance and discovery, exploitation, post-exploitation and reporting.
Written authorization and agreed rules of engagement come before any penetration test. Testing without permission is an attack, not a test.
Teams
Red team attacks, blue team defends, purple team combines them so findings improve defenses directly.
Testing approaches
| Term | Meaning |
|---|---|
| Static testing | Without running code (SAST, reviews) |
| Dynamic testing | Running the application (DAST, fuzzing) |
| Fuzzing | Sending malformed or random input to find crashes and flaws |
| Positive and negative testing | Valid inputs work; invalid inputs are rejected safely |
| Regression testing | Changes have not broken earlier behaviour |
How the exam asks about this
- "Which test confirms an attacker can chain weaknesses into a breach?" A penetration test.
- "Monitor availability of a checkout flow every five minutes." Synthetic transactions.
- "Quarterly scans miss vulnerable packages in short-lived containers." Scan images in the registry and pipeline and block vulnerable ones.
What to remember for the exam
- Scans find; penetration tests prove; code review finds flaws in source.
- Authenticated scans are more accurate.
- Black, gray and white box describe tester knowledge.
- Synthetic transactions test proactively; real user monitoring observes actual use.
- Always get written authorization before penetration testing.
A clean vulnerability scan does not mean a system is secure. It means no known issues were found by that scan.
Common mistakes
Using a penetration test as a full inventory of weaknesses.
Running unauthenticated scans and trusting the results as complete.
Testing production without agreed rules of engagement.
Check yourself
What does a penetration test show that a vulnerability scan does not?
Whether weaknesses can actually be exploited and chained to reach a goal.
What is a synthetic transaction?
A scripted transaction run against a system to test availability and functionality.
What must be in place before a penetration test begins?
Written authorization and agreed rules of engagement.
Topic 2 of 3 in Security Assessment and Testing
Test yourself on Security Assessment and Testing
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.