Key Terminology
Assessment vs. Audit
Security Assessment: An evaluation of controls to see if they meet management expectations. It is often broader and less formal than an audit.
Security Audit: A formal evaluation against a specific compliance standard. It is usually performed by independent individuals (auditors) to validate risk or evaluate a particular criterion.
Internal Audit: An audit performed by the organisation's own staff to improve efficiency and prepare for external audits.
External Audit: A third-party assessment governed by an audit charter to ensure compliance with regulations.
Testing Methods
Code Review: Checking software code to ensure no backdoors exist, functions work as intended, and coding standards are met.
Interface Testing: Testing the connections between different components of an application to ensure they work correctly together.
Misuse Case Testing: Testing how a system reacts to malicious or accidental actions that could cause failures (e.g., what happens if a hacker tries to break it).
Negative Testing: Testing to see whether the application handles invalid input or unexpected behaviour gracefully (aims to crash the system).
Positive Testing: Testing to verify the system works as expected under normal conditions.
Penetration Testing: Simulating a cyberattack to identify vulnerabilities. It includes discovery, scanning, exploitation, and reporting.
Synthetic Performance Monitoring: Using scripts or recorded actions to simulate user activity and check system performance (e.g., website speed).
Management and Processes
Log Management: The process of generating, storing, and protecting system logs. Regulations like HIPAA and PCI DSS require these.
PDCA Cycle: A four-step management model for continuous improvement: Plan, Do, Check, Act.
Key Risk Indicators (KRIs): Metrics used to monitor emerging risks and alert management when risk levels exceed limits.
Vulnerability Equities Process (VEP): A government process for deciding whether to disclose zero-day vulnerabilities or keep them secret for intelligence use.
Project Zero: A research team (by Google) that finds zero-day vulnerabilities and gives vendors 90 days to fix them before public disclosure.
Training
Awareness: Focuses on keeping security issues "top of mind" for staff (general).
Training: Focuses on teaching specific skills required for a job.
Education: Provides broad knowledge and understanding