Certified Information Systems Security Professional (CISSP) Exam Guide

14

Designing and Conducting Security Assessments

You can take steps to deploy security management, logical, and operational controls, but they are meaningless unless you verify and validate that the controls are working. For this reason, there are a variety of different ways of testing your architecture depending on your goals, and they will be covered in this chapter. Audits are among the most common methods for assessing the security posture of your organization, as well as that of your partners. They can be conducted internally, externally, or by a third party.

However, audits focus on the overall security landscape and are large-scale undertakings. Security managers should also consider ongoing testing, including regular code reviews, continuous ...