Audits: Systematic evaluations of an organizations information systems, applications, and security controls.
Assessments: Detailed analysis of an organizations security systems to identify vulnerabilities and risks.
Systematic evaluation of effectiveness of internal controls, compliance, and integrity of information systems and processes.
Steps
Ensuring that information systems and security practice meet established standards, regulations, and laws.
Group of people responsible for supervising organizations audit and compliance functions. Often members of board of directories.
In-depth analysis to identify and assess potential risks and vulnerabilities in an organizations information systems.
Internal review conducted by organization to gauge its adherence to particular standards or regulations. A large organization may have a dedicated internal assessment team that travels throughout the enterprise to evaluate the network.
Steps:
Lists yes or no questions with section for Department/Vendor, Comments, Action Items, and Assigned To. Helps organizations identify and strengthen data security areas internally. Should be worked on with many people to ensure risks are understood.
External audits are performed by independent third parties to validate compliance and security posture without internal bias.
Detailed analysis conducted by independent entity to identify vulnerabilities and risks. Forms: Risk assessment, Vulnerability assessment, Threat assessment.
Objective that organizations aim to reach in adherence to applicable laws, policies, and regulations. Involves adhering to industry specific requirements (e.g., HIPAA and PCI DSS) and broader regulations (e.g., GDPR).
Comprehensive security infrastructure inspections that are conducted externally. Also review policies, procedures, and controls, and address weaknesses.
Offers validation of security practices, fostering trust with customers, stakeholders, and regulatory authorities. Many regulations mandate regular independent third-party audits.
Simulated cyber attack that helps in assessment of computer systems.
Tests organizations physical security to find physical vulnerabilities, improve security awareness, prevent unauthorized access.
Proactive approach that involves use of attack techniques, akin to real cyber attacks. Simulates real-world attacks.
Reactive approach that entails fortifying systems, identifying and addressing attacks, and enhancing incident response times (e.g., monitoring a network for abnormal traffic).
Combination of offensive and defensive testing into a single penetration test. Blue team will try to detect red team attacks (attacks escalate).
Initial phase where critical information about target system is gathered to enhance an attack’s effectiveness and success.
Metasploit: Multi-purpose computer security and penetration testing framework that encompasses a wide array of powerful tools, enabling execution of penetration tests.
Attestation: Process that involves formal validation or confirmation provided by an entity that is used to assert the accuracy and authenticity of specific information. Way to prove a pentest actually happened and the findings were valid.
Attestation v. Mere Report: In a report of your findings, you may say that you were able to bypass MFA. In attestation, you will have to show evidence the exploit happened. During attestation you can show things like exploit code, but unlike a report, the organization does not need to get a copy of this.