Assessment and Testing Overview
Why test?
Controls decay. Assessment and testing verify that the controls management believes are in place are actually working, and produce the evidence auditors and regulators require. A test strategy should combine automated scanning, manual testing, and process review.
- Vulnerability scanning — broad, automated, identifies known weaknesses; produces false positives.
- Penetration testing — goal-oriented exploitation to demonstrate real impact.
- Zero-knowledge (black box), partial-knowledge (grey box), and full-knowledge (white box) tests.
- Blind, double-blind, and targeted tests describe what the defenders know.
- Code review, static (SAST) and dynamic (DAST) analysis, fuzzing, and misuse case testing.
The penetration testing process
- Planning and written authorization — the scope and rules of engagement must be signed first.
- Discovery and reconnaissance — passive then active information gathering.
- Enumeration and vulnerability mapping.
- Exploitation, then optional privilege escalation and pivoting.
- Reporting — findings, business risk, and prioritized remediation.
Exam tip
Never begin any test without documented, signed management approval. Unauthorized testing is a crime regardless of intent.