Domain 6: Security Assessment and Testing
Vocabulary first
Testing = execute and observe (e.g., pen test, scan). Assessment = broader judgement incl. risk and process review. Audit = independent, evidence-based opinion against a standard/criteria. Verification = building the system right (matches design); Validation = building the right system (meets the need).
Vulnerability scanning
- Types: network discovery, network vulnerability, web application, database scans.
- Intrusive vs non-intrusive; authenticated (credentialed) scans see far more.
- Output hygiene: false positives need verification; track with a risk-based SLA (critical < 7 days style).
- Coding the findings: CVE (identifier), CVSS (0–10 severity score, v3.1 base metrics = AV/AC/PR/UI + C/I/A), CPE (product naming), CCE (configuration), XCCDF/OVAL (SCAP languages for automatable checks).
Penetration testing
Non-negotiable first step: written authorisation and scope (rules of engagement, windows, escalation contacts).
Phases: recon (passive OSINT / active scanning) → scanning & enumeration → exploitation → persistence/lateral movement → covering tracks (within scope) → reporting (exec summary + technical detail + remediation).
Knowledge levels: black box (no info), grey box (partial), white box (full). Red team = adversary emulation vs blue team (defence); purple teaming = collaborative improvement.
Software testing toolbox (see D8 for depth)
- SAST static/white-box source analysis; DAST dynamic/black-box running app; IAST runtime instrumentation; RASP self-protecting app.
- Fuzzing: mutational (mutate existing inputs) vs generative (build from grammar); great for parsers/protocols.
- Misuse-case testing, test coverage analysis, regression on every change; SCA (software composition) for third-party components; SBOM tracking.
OWASP Top 10 (2021) — be able to match names
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery (SSRF)
Operational testing and monitoring data
Synthetic transactions (robot users), RUM real-user monitoring, log reviews, account management reviews (are leavers gone? who approved access?), management reviews of risk, KPIs (performance) vs KRIs (early-warning risk indicators), agreement/supply-chain reviews.
Audits, attestations, and reports
| Thing | Know this |
|---|---|
| SOC 1 | controls at financial-statement relevant processes |
| SOC 2 | security/availability/confidentiality/processing/privacy trust criteria; Type I = design at a point in time, Type II = design + operating effectiveness over a period |
| SOC 3 | public summary, no details |
| ISO 27001/27002 | ISMS certifiable standard / control catalogue |
| ISO 27701 | privacy extension (PIMS) |
| PCI DSS | 12 requirements for card data; SAQ/ROC by volume |
| FedRAMP / FISMA | US federal authorisations |
| CSA STAR | cloud controls registry |
Auditor independence is mandatory for external audits; internal audit reports to the board/audit committee, not to the CISO it audits.
Memory hooks
- Pen test sequence: authorisation → recon → scan → exploit → report.
- SOC 2 Type II = ‘over a period of time, tested’; Type I = point-in-time design.
- CVSS ≥ 9.0 = Critical band (9.0–10), High 7–8.9, Medium 4–6.9, Low 0.1–3.9.
- SAST = source, DAST = running app, SCA = dependencies.
- SCAP family: XCCDF + OVAL + CCE + CPE + CVE.
Exam tips
- ‘What comes FIRST in a pen test?’ → permission/scope. Always.
- False positive = tool cried wolf; false negative = tool missed a real issue (worse).
- Authenticated scans find more; intranet-only scanning misses shadow IT.
- For cloud: customer still gets assessed for what they configure (shared responsibility).