Security Assessment, Testing, and Monitoring
Core ideas
Assessment verifies controls work. Know vulnerability scanning (broad, automated) vs. penetration testing (exploits, manual), and SAST/DAST/SCA for code. Testing types: black-box, white-box, gray-box. Logging, monitoring, and SIEM correlate events; IDS/IPS and EDR detect host/network threats. Metrics and KPIs show control effectiveness.
Concepts to master
Rules of engagement and scope/authorization for testing. False positives vs. false negatives and tuning. Baselining and anomaly detection. Continuous monitoring, log retention, and time synchronization. Vulnerability management lifecycle (identify, prioritize by risk, remediate, verify). CVSS as a severity scoring aid-not the sole decision input.
Traps
Scanning is not exploiting; a scan finding is not proof of exploitability. Testing without written authorization is illegal-scope matters. A high CVSS score does not automatically mean top priority; context (exposure, asset criticality) matters. False negatives are more dangerous than false positives because threats go undetected.
Worked example
A scanner flags a critical CVE on an internal server with no network exposure. Prioritize by risk: confirm the vulnerable service is reachable and the asset's criticality before emergency patching; document the decision.
Rule of thumb: assess → prioritize by real risk → remediate → re-test to verify.