Everand Logo

Welcome to Everand!

  • Discover millions of ebooks, audiobooks, and so much more with a free trial

    Only €10,99/month after trial. Cancel anytime.

    Security Assessment and Testing: CISSP, #6
    Security Assessment and Testing: CISSP, #6
    Security Assessment and Testing: CISSP, #6
    Ebook105 pages59 minutes

    Security Assessment and Testing: CISSP, #6

    By Selwyn Classen

    2/5

    ()

    Read preview

    About this ebook

    Security Assessment and Testing is the 6th domain of the CISSP's common body of knowledge. In this course we will cover the following: assessment and testing strategies, security control effectiveness testing. security process data collection, test result analysis, third-party assessment and Information Security Continuous Monitoring (ISCM), 

    LanguageEnglish
    PublisherSelwyn Classen
    Release dateApr 2, 2020
    ISBN9781393059080
    Security Assessment and Testing: CISSP, #6
    Author

    Selwyn Classen

    A seasoned and highly qualified IT/IS professional with over 20 years working experience within the Petrochemical industry (i.e. Supply chain management, Knowledge management, Product and Quality management, Business analysis and processing) including the Telecommunications industry.

    Read more from Selwyn Classen

    Related to Security Assessment and Testing

    Titles in the series (8)

    View More
    View More

    Related ebooks

    Security For You

    View More
    View More

    Related podcast episodes

    Related articles

    • Article

      Web App Security

      Jun 29, 2021

      Web App Security
      8 min read

    • Article

      Network monitoring 2022

      Feb 10, 2022

      Network monitoring 2022
      4 min read

    • Article

      Auditing Your Security

      Aug 26, 2019

      Auditing Your Security
      4 min read

    • Article

      Creating a Cybersecurity Checklist

      Aug 25, 2021

      Cybersecurity technology has experienced a tremendous surge in consumer interest in 2021 that has shown no signs of slowing down. The trend is largely because developers are introducing numerous innovations in this realm, at a pace that meets market

      4 min read

    • Article

      Building a Cybersecurity Fence

      Jan 30, 2019

      Building a Cybersecurity Fence
      4 min read

    • Article

      Vulnerability Assessments

      Jan 7, 2021

      Vulnerability Assessments
      3 min read

    • Article

      “Someone Who Under Takes A Ransomware Attack Isn’t A Hacker, They’re An Attacker”

      Aug 12, 2021

      If you’ve ever attended an infosec or cybersecurity event, you will no doubt have noticed the preponderance of “Hacking is NOT a Crime” stickers. In 2018, some 500 such stickers were handed out at the DEF CON 26 event, the following year 5,000 were d

      7 min read

    • Article

      The Weakest Link

      Jun 24, 2018

      The Weakest Link
      7 min read

    • Article

      Under Cyber Attack

      Apr 16, 2020

      Under Cyber Attack
      9 min read

    • Article

      Social Engineering

      Oct 15, 2019

      Social Engineering
      5 min read

    • Article

      Protect Your Data

      Jul 13, 2020

      Protect Your Data
      13 min read

    • Article

      Your Best Defence Against Cyber-attacks

      Jul 21, 2021

      There is no better time than today to plan for how you’ll respond to a serious cyber-attack. Instigating a rock-solid cyber response plan requires identifying the risk to your business at a senior governance level, and understanding who is responsibl

      3 min read

    • Article

      Cyber Security IS A SHARED RESPONSIBILITY AT THE C-LEVEL

      Sep 21, 2016

      Data breaches can have far-reaching repercussions; protecting against them is a companywide mandate

      2 min read

    • Article

      Network Attacks

      Sep 21, 2020

      Though less common than malware and social engineering, network-based attacks are still a threat to every computer and mobile user, and everyone should have at least a basic understanding of what they are and how to avoid them. So this month let’s lo

      4 min read

    • Article

      Hacker’s Manual

      Mar 2, 2021

      Hacker’s Manual
      1 min read

    Related categories

    Reviews for Security Assessment and Testing

    2/5

    1 rating0 reviews

    What did you think?

    Tap to rate

    Review must be at least 10 words

      Book preview

      Security Assessment and Testing - Selwyn Classen

      While every precaution has been taken in the preparation of this book, the publisher assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein.

      SECURITY ASSESSMENT AND TESTING

      First edition. April 2, 2020.

      Copyright © 2020 Selwyn Classen.

      Written by Selwyn Classen.

      Table of Contents

      Assessment and Testing Strategies

      Course Introduction

      Ensuring Objectives Have Been Met

      Resource Constraints

      Security Assessment Foundations

      Security Assessment Program

      Assessment Viewpoints

      Assessment Types

      Summary

      Security Control Effectiveness Testing

      Introduction

      Vulnerability Assessment

      Detection

      Identification

      Analysis

      Reporting

      Mitigation

      Intro to Penetration Testing

      Penetration Testing

      Test Process Walkthrough

      Selecting Target Surface

      Destructing and Non-destructive Testing

      Penetration Testing Frameworks

      CISSP Exam Tip

      Penetration Testing Process

      Scoping the Test

      Enumeration

      Identification

      Security Assessment Techniques

      Source Code Review

      Summary

      Security Process Data Collection

      Introduction

      Key Performance Risk Indicators

      Management Review

      Training and Awareness

      Account Management

      Disaster Recovery and Business Continuity

      Backup Data Verification

      Summary

      Test Result Analysis

      Introduction

      Vulnerability Assessment

      Vulnerability Assessment Dashboards

      Targeted Reporting

      Data Analysis

      Penetration Testing Reports

      Reporting Challenges

      Penetration Testing Report Anatomy

      Summary

      Third-party Assessment

      Introduction

      Third-party Vendors

      Evaluating Guidelines

      Audit Reports

      SSAE16

      Audit Stages

      Summary

      Information Security Continuous Monitoring

      Introduction

      What Is ISCM?

      ISCM Strategy

      Defining Your ISCM Program Strategy

      Establishing Your ISCM Program Strategy

      Implementing Your ISCM Program Strategy

      Analyzing Your ISCM Program Strategy

      Respond to ISCM Findings

      Review Your ISCM Program Strategy

      Summary

      Assessment and Testing Strategies

      Course Introduction

      Let us assume that your controls have been selected and implemented, your users have been educated, and everything seems to be in order. Even if this is the case, the odds are that there are still unknown risks in your environment and if you want to be confident that your controls are working as intended, you will need to perform security and risk assessment. If you take a look at the CISSP exam outline, you will find that a CISSP candidate will be expected to understand how to design and validate assessments and test strategies, conduct security control testing, collect security control data, analyze and report test outputs, and conduct or facilitate internal and third-party audits. The requirements that were just listed all stem from the very same need.

      Let me give you a quick example of this. Depending on the size of the organization, there is a chance that many employees believe that all necessary security controls are already in place. Unfortunately, this is simply an assumption and one that is often incorrect. As a security professional, you may need to provide your leadership with the assurance that your systems are secure and to do that; you will need to have effective and repeatable security testing and assessment processes in place. In this module and throughout the entire course, you are going to learn what this entails. Security testing will require that you leverage all of the information that you have learned in the other CISSP domains. You may be asked to work with product owners to build out procedures and processes that validate the effectiveness of security controls. When planning for testing and creating your test strategies, you may be required to work with product owners to build out procedures and processes that validate the effectiveness of security controls.

      Now that you have a basic understanding of what ISE Squared expects a candidate to know in regards to security assessment and testing. Let us go ahead and get started on the first topic of this course, assessment and testing strategies. This module attempts to cover the broad spectrum of security assessment and testing-related ideas, concepts, and terminology that is the foundation for any advanced security professional. This course module also reinforces your existing security assessment knowledge and will focus on the concepts necessary for adequately designing and validating security assessments. Now, although this course does not contain technological demonstrations, much of the information that will be shared should be immediately useful when you are planning for or even executing your security assessments.

      You will learn why developing a strategy for security assessment, and testing is important and what the different assessment types are and what you should know in regards to resources and how they might impact your assessments. You will also learn about the overall security testing and assessment process so that you can be both effective and efficient when developing your strategies. 

      Ensuring Objectives Have Been Met

      Information security assessment is an activity that is focused on assuring that security objectives have been met. This can be accomplished by testing your environment and validating that everything is working the way that you had originally planned when performing due diligence. This could include the security objectives that are driven by regulatory requirements, or it could be the items that are in your organizational policies. Security testing will ensure that your controls are working properly, and when they do not, it will help you to identify those areas

      Enjoying the preview?
      Page 1 of 1