The Security Risk Assessment Handbook, 2nd Edition

Technical Data Gathering  ◾  265

© 2011 by Taylor & Francis Group, LLC

7.2.5 Test Technical Security Controls

e last phase of data gathering for technical security controls in the RIIOT method

is testing. Testing of technical security controls is the process of invoking condi-

tions that test technical controls against their intended security functions. is type

of data gathering provides excellent insight into the eectiveness of the controls.

e technical controls that lend themselves to testing include monitoring tech-

nology, audit logs, anti-virus systems, automated password policies, VPN, rewalls,

IDSs, and system hardening. An approach for ...