OSSTMM divides the testing types into six broad categories based on the amount of information known to the tester:
- Blind: In this test, the analyst has no knowledge of the target, but the target knows about the audit and has all the details of the analyst. This can be considered a test of the analyst's knowledge.
- Double-Blind: In this test, the analyst has no knowledge of the target, its defenses, assets, and so on. The target is also not notified of the audit. This test is used to check the knowledge and skills of the analyst as well as the preparedness of the target against unknown threats. This is also known as a black box test.
- Gray Box: In this test, the analyst has limited knowledge of the defenses of the target, ...