Verifying and monitoring application security
Verification vs validation
Verification confirms that an Application Security Control (ASC) was built as specified. Validation confirms that the application meets its security requirements in operation. ISO/IEC 27034-4 addresses validation and verification; the exam tests whether you can choose the right method and evidence for each ASC.
Core rules
- Use methods such as code review, configuration review, static and dynamic analysis, penetration testing, and audit.
- Define acceptance criteria and evidence before testing.
- Monitor continuously: logs, metrics, vulnerability scans, runtime protection, and incident trends.
- For high Targeted Assurance Levels, require independent verification.
- Feed verification results back into the Application Normative Framework (ANF) status.
Worked example
An ASC requires multi-factor authentication for administrators. Verification uses code review and configuration checks to confirm MFA is enforced. Validation uses a penetration test that attempts bypass, plus monitoring of MFA success and failure rates. If a bypass is found, the ASC is reopened, remediated, and re-verified before the ANF status returns to compliant.
Traps
Confusing verification with validation is a classic error: verification is "built right," validation is "right control for the requirement." One-time testing without continuous monitoring leaves drift undetected. Monitoring without thresholds and owners produces data but no assurance.