More

    Technical Guide to Information Security Testing and Assessment

    Technical Guide to Information Security Testing and Assessment

    This guide explains the basic technical aspects of conducting information security assessments, from technical testing and examination methods and techniques to insights on the potential impact they may have on systems and networks.

    An information security assessment is the process of determining how effectively an
    entity being assessed (e.g., host, system, network, procedure, person — known as
    the assessment object) meets specific security objectives. Three types of assessment
    methods can be used to accomplish this — testing, examination, and interviewing.
    Testing is the process of exercising one or more assessment objects under specified
    conditions to compare actual and expected behaviors. Examination is the process of
    checking, inspecting, reviewing, observing, studying, or analyzing one or more
    assessment objects to facilitate understanding, achieve clarification, or obtain
    evidence. Interviewing is the process of conducting discussions with individuals or
    groups within an organization to facilitate understanding, achieve clarification, or
    identify the location of evidence. Assessment results are used to support the
    determination of security control effectiveness over time.

    This document, provided by the National Institute of Standards and Technology, is a
    guide to the basic technical aspects of conducting information security assessments. It
    presents technical testing and examination methods and techniques that an organization
    might use as part of an assessment, and offers insights to assessors on their execution
    and the potential impact they may have on systems and networks. For an assessment to be
    successful and have a positive impact on the security posture of a system (and
    ultimately the entire organization), elements beyond the execution of testing and
    examination must support the technical process. Suggestions for these activities
    — including a robust planning process, root cause analysis, and tailored
    reporting — are also presented in this guide.

    The attached Zip file includes:

    • Intro Page.doc
    • Cover Sheet and Terms.pdf
    • Technical Guide to Information Security Testing and Assessment.pdf

    Latest Articles