Security Assessment and Testing
Security Assessment and Testing tests how controls are validated, how findings are prioritized, and how testing is scoped and governed. Questions distinguish audits, vulnerability scans, penetration tests, and code review, and ask how metrics and sampling affect conclusions.
Core rules and concepts
- An audit checks evidence against criteria; a vulnerability scan identifies known weaknesses; a penetration test exploits weaknesses under rules of engagement; code review inspects source.
- CVSS base metrics describe intrinsic severity; temporal metrics change over time; environmental metrics reflect the organization. Prioritize with exposure, asset criticality, and exploitability, not base score alone.
- Sampling must be representative; a clean sample does not prove a population is clean. Coverage metrics show what was tested, not what is secure.
- Test authorization, scope, and data handling must be documented. Production testing requires safeguards to avoid outage or data loss.
- Metrics should be actionable: mean time to remediate, percentage of critical findings closed on time, and false-positive rate.
Worked example
A scanner reports a CVSS 9.8 vulnerability on an internal test server with no internet exposure and no sensitive data. A CVSS 7.5 vulnerability sits on an internet-facing payment gateway. Base scores alone would put the 9.8 first. Environmental scoring lowers the test server because confidentiality, integrity, and availability impact are limited; the gateway rises because exposure and business criticality are high. The team validates both findings, confirms the gateway issue is not a false positive, and remediates it first under change control. The test server is patched in the next maintenance window.
Traps
Equating a scan with a penetration test; using base CVSS as the only priority; treating a sample as proof of full coverage; and testing without written authorization.