ISC2 CISSP Certified Information Systems Security Professional Official Study Guide, 10th Edition

Chapter 15Security Assessment and Testing

THE CISSP TOPICS COVERED IN  THIS CHAPTER INCLUDE:

• Domain 6.0: Security Assessment and Testing
  • 6.1 Design and validate assessment, test, and audit strategies
    • 6.1.1 Internal (e.g., within organization control)
    • 6.1.2 External (e.g., outside organization control)
    • 6.1.3 Third-party (e.g., outside of enterprise control)
    • 6.1.4 Location (e.g., on-premise, cloud, hybrid)
  • 6.2 Conduct security controls testing
    • 6.2.1 Vulnerability assessment
    • 6.2.2 Penetration testing (e.g., red, blue, and/or purple team exercises)
    • 6.2.3 Log reviews
    • 6.2.4 Synthetic transactions/benchmarks
    • 6.2.5 Code review and testing
    • 6.2.6 Misuse case testing
    • 6.2.7 Coverage analysis
    • 6.2.8 Interface testing (e.g., user interface, network ...