Auditing IT Infrastructures for Compliance, 3rd Edition

Penetration Testing and Validating LAN-to-WAN Configuration

Testing security controls and configuration settings is crucial to ensuring you have the right controls in place. One particular type of testing simulates actions an attacker would take to attack your network. This type of test is called a penetration test because the purpose of the test is to attempt to penetrate, or compromise, your security controls. In fact, conducting periodic penetration tests is a requirement for compliance with several standards. PCI DSS is one example of a standard that requires annual penetration tests to validate security controls.

An experienced penetration tester can simulate the actions an attacker would take and verify the strength of your security controls. ...