Domain 5 of 5 · Chapter 5 of 5

Understand Security Testing

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • What security testing is and where this page sits
  • Rules of engagement: the permission behind every test
  • Tests can disrupt the systems they test
  • Security readiness testing: red, blue and purple teams
  • Judging readiness by detection and response
  • Application testing across the development life cycle
  • Vulnerability scanning: how a scanner finds weaknesses
  • Reading scan results: validate, prioritize, know the limits
  • Penetration testing: from suspected to exploitable
  • Threat modeling: finding problems in the design
  • STRIDE: six prompts for what can go wrong
  • Static analysis: examining code without running it
  • Dynamic analysis: testing the running application
  • Physical penetration testing: getting past doors and people
  • Phishing, tailgating and impersonation tests
  • Retesting fixes and testing again over time

The three families of security testing

AspectSecurity readiness testingApplication testingPhysical penetration testing
Question it answersDo defenders detect and respond to realistic attack activity?Where are the software and systems weak, and can the weaknesses be exploited?Do entry controls and staff procedures stop unauthorized access?
What is examinedThe blue team's people, processes and toolsDesigns, source code, running applications and deployed systemsEntry points, barriers and how staff verify identity and authority
Typical techniquesRed team exercise, purple teamingThreat modeling, static analysis, dynamic analysis, vulnerability scanning, penetration testingPhishing simulation, tailgating, impersonation
Evidence it producesWhat defenders saw, how fast they acted, what to tuneSuspected and confirmed weaknesses, prioritized in contextWhich attempts succeeded and whether staff verified or reported them
Tempting misreadingCounting installed security products as readinessTreating a scan finding as a breach, or a clean scan as proof of safetyTreating a clean network scan as proof the building is secure

Decision tree

What does the test target?Detection and responseSoftware and systemsEntry controls and staff proceduresShare each techniquewith defenders as you go?What exists to examine?Physical penetration testphishing, tailgating, impersonationYesNoPurple teamingshared learningRed team exercisetests the blue teamA designSource codeRunning applicationDeployed systemsThreat modelingbefore code existsStatic analysiswithout running itDynamic analysisobserves it runningNeed proof a weaknesscan be exploited?NoYesVulnerability scanningsuspected weaknessesPenetration testattempts exploitationFirst, always: the test type is authorized in the rules of engagement
Cheat sheet

Cheat sheet

  • A red team emulates adversaries within authorized test boundaries
  • A blue team defends systems and evaluates detection and response
  • Purple teaming joins offensive and defensive learning
  • Readiness testing should show whether defenses work against tested behavior
  • Rules of engagement define permitted testing activities and limits
  • Vulnerability scanning identifies suspected weaknesses for review
  • Penetration testing investigates exploitability beyond an isolated scan finding
  • Credentialed scans can examine details unavailable to an unauthenticated scan
  • Scanner results require validation and contextual prioritization
  • A clean scan is limited by what the scanner could see and recognize
  • Security tests can affect systems and need operational coordination
  • Security testing must recur as systems and threats change
  • Static analysis examines source code or compiled code without executing the application
  • Dynamic analysis tests a running application's behavior
  • Threat modeling identifies potential security problems before implementation
  • Data flows and trust boundaries help locate where protection assumptions change
  • STRIDE provides prompts for considering different kinds of threats
  • A security fix needs validation against the original finding
  • Physical penetration testing evaluates protection against unauthorized physical access
  • Tailgating reveals a failure to verify each person's entry authorization
  • Impersonation tests whether staff verify claimed identity and authority
  • Phishing simulations evaluate how people handle deceptive requests
  • Authorization for technical testing does not automatically include physical or social-engineering tests

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
  2. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  3. https://csrc.nist.gov/glossary/term/rules_of_engagement
  4. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
  5. https://csrc.nist.gov/glossary/term/red_team
  6. https://csrc.nist.gov/glossary/term/blue_team
  7. https://www.isaca.org/resources/isaca-journal/issues/2022/volume-1/strengthening-cybersecurity-with-red-team-engagements
  8. https://csrc.nist.gov/glossary/term/white_team
  9. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a
  10. https://csrc.nist.gov/glossary/term/vulnerability_scanning
  11. https://csrc.nist.gov/glossary/term/false_positive
  12. https://csrc.nist.gov/glossary/term/penetration_testing
  13. https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html
  14. https://csrc.nist.gov/glossary/term/threat_modeling
  15. https://owasp.org/www-community/Threat_Modeling
  16. https://owasp.org/www-community/Threat_Modeling_Process
  17. https://csrc.nist.gov/glossary/term/tampering
  18. https://owasp.org/www-community/Source_Code_Analysis_Tools
  19. https://owasp.org/www-community/Vulnerability_Scanning_Tools
  20. https://csrc.nist.gov/glossary/term/phishing
  21. https://csrc.nist.gov/glossary/term/spoofing
  22. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf