6

I am a bit confused by security audit and security testing, do they not both test against security holes?

What are the differences between them?

6

Differences between security audit and security testing

  • Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes with more technical focus.
  • Security audit is testing something that is difficult to be tested directly (do passwords change on a regular basis?), while security testing normally has a direct approach (is a password too weak?).

Security audit and security testing share something in common as well

  • They have the same purpose and that is to locate vulnerability.
  • For some companies, security testing can be part of security audit.
  • 1
    Nicely stated. Normally audit evaluates vulnerabilities and how policy is applied to them. Testing often goes much farther in that it will involve providing proof of vulnerability relative to the organization being tested, as well as potential remediation methods. – maznika Mar 16 '17 at 1:05
3

An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party doing that. Security testing could be for development/penetration/boundary/audit/etc...

In general I would hope that the security testing performed is matching up with what the security audit will be targeting. Usually an audit is there to certify approval and maintain consistency with regards to security. You don't want to let security be approved once and then get lax, so they periodically audit security to ensure that proper patching and upgrades have taken place to keep the system/application secure.

The terms of your question are generic, if you have more specific terms like penetration testing, vulnerability assessment, various other approved certifications on application security then the nuances of those difference could be called out.

2

Frequency

  • A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be performed by a different group than those who write the software and the security tests that go with it.

  • Security testing is a constant on-going practice, ideally done for each change in the software as part of application development and/or as part of the code that handles security aspects such as authentication and authorization.

  • Thank you very much. I thought Security audit is a regular exercise. – oscar Mar 15 '17 at 22:23
  • can be regular but usually one a quarter or once a year – Michael Durrant Mar 15 '17 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.