Audits and assessments
Exam objective 5.5: Explain types and purposes of audits and assessments.
On this page
Audits and assessments verify that controls work. This objective covers attestation, internal audits and self-assessments, external audits and regulatory examinations, and penetration testing approaches: physical, offensive, defensive, integrated, known, partially known, unknown environments, and reconnaissance.
Internal and external
Internal audits are run by the organization's own audit function and report to an audit committee; self-assessments are lighter checks by the team itself. External audits are run by independent firms or regulators; regulatory examinations are mandated by law; independent third-party audits give customers assurance.
Penetration testing
| Environment | Tester knows | Simulates |
|---|---|---|
| Known (white box) | Full details: diagrams, code, credentials | Insider or thorough review |
| Partially known (gray box) | Some information | An attacker with some access |
| Unknown (black box) | Nothing beyond the target name | An outside attacker |
Offensive testing (red team) attacks; defensive testing (blue team) defends; integrated testing (purple team) has both work together to improve. Physical penetration tests try to get into buildings. Reconnaissance can be passive (public sources, no contact with the target) or active (scanning and probing the target directly).
Key terms
- Internal audit
- An audit performed by the organization's own independent audit function.
- External audit
- An audit performed by an independent outside firm or regulator.
- Regulatory examination
- An audit or inspection required and conducted by a regulator.
- Self-assessment
- A review an organization or team performs on its own controls.
- Known environment test
- A penetration test where testers receive full information about the target.
- Partially known environment test
- A penetration test where testers receive some information about the target.
- Unknown environment test
- A penetration test where testers start with no inside information.
- Passive reconnaissance
- Gathering information about a target without directly interacting with its systems.
- Active reconnaissance
- Gathering information by directly probing a target's systems, such as port scanning.
- Red team
- A group that simulates real attackers to test an organization's defenses.
- Purple team
- Attackers and defenders working together to improve detection and response.
- Physical penetration test
- A test of whether testers can get into buildings and secure areas.
Check yourself
24 practice questions on this objective
Practice this objectiveFlashcards for this objective