5.5 Explain types and purposes of audits and assessments

These flashcards cover key concepts related to audits, assessments, and penetration testing as discussed in the lecture notes.

Audits involve systematically evaluating __________, controls, and compliance with established standards, policies, and regulations.

processes

Assessments help identify vulnerabilities, assess risks, and provide insights for enhancing __________ measures.

security

Attestation refers to verifying and validating the __________, reliability, and effectiveness of security controls, systems, and processes.

accuracy

Attestation provides assurance to stakeholders that an organization's security measures are adequate and effective in protecting __________ information.

sensitive

Internal assessments are conducted by the organization's own __________.

employees

External assessments are conducted by independent __________ service providers.

third-party

Audit committees enhance the integrity of financial statements and ensure compliance with legal and __________ requirements.

regulatory

Self-assessments allow organizations to evaluate their performance against __________ metrics and measures.

predetermined

Regulatory assessments evaluate whether organizations adhere to mandatory __________ requirements.

regulatory

Penetration testing uses authorized hacking techniques to discover exploitable __________ in the target's security systems.

weaknesses

Active reconnaissance involves actively probing and interacting with target systems to gather __________.

information

Passive reconnaissance focuses on collecting publicly available data and observing network __________.

traffic

Known environment penetration testing involves testers having detailed knowledge about the target system or __________.

network

The goal of unknown environment penetration testing is to identify potential __________ without prior knowledge.

vulnerabilities

Offensive penetration testing simulates real-world cyberattacks to identify vulnerabilities that malicious actors could __________.

exploit

Defensive penetration testing evaluates an organization's defensive security measures and overall __________ against cyber threats.

resilience

Integrated penetration testing aims to provide a comprehensive evaluation of an organization's security operations by combining different types of __________ testing methodologies.

penetration