Designing and Conducting Security Assessments

You can take steps to deploy security management, logical, and operational controls, but they are meaningless unless you verify and validate that the controls are working. For this reason, there are a variety of different ways of testing your architecture depending on your goals, and they will be covered in this chapter. Audits are among the most common methods for assessing the security posture of your organization, as well as that of your partners. They can be conducted internally, externally, or by a third party.

However, audits focus on the overall security landscape and are large-scale undertakings. Security managers should also consider ongoing testing, including regular code reviews, continuous monitoring of tools and operations, and conducting penetration testing to evaluate the organization’s resilience to simulated real-world threats.

For these tests to be effective, you should clearly define your goals, get buy-in...