8

I am a bit confused by security audit and security testing, do they not both test against security holes?

What are the differences between them?

Improve this question
0

4 Answers 4

Reset to default
7

Differences between security audit and security testing

  • Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes with more technical focus.
  • Security audit is testing something that is difficult to be tested directly (do passwords change on a regular basis?), while security testing normally has a direct approach (is a password too weak?).

Security audit and security testing share something in common as well

  • They have the same purpose and that is to locate vulnerability.
  • For some companies, security testing can be part of security audit.
Improve this answer
1
  • 1
    Nicely stated. Normally audit evaluates vulnerabilities and how policy is applied to them. Testing often goes much farther in that it will involve providing proof of vulnerability relative to the organization being tested, as well as potential remediation methods.
    – maznika
    Mar 16, 2017 at 1:05
3

Frequency

  • A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be performed by a different group than those who write the software and the security tests that go with it.

  • Security testing is a constant on-going practice, ideally done for each change in the software as part of application development and/or as part of the code that handles security aspects such as authentication and authorization.

Improve this answer
2
  • Thank you very much. I thought Security audit is a regular exercise.
    – oscar
    Mar 15, 2017 at 22:23
  • can be regular but usually one a quarter or once a year
    – Michael Durrant
    Mar 15, 2017 at 22:30
3

An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party doing that. Security testing could be for development/penetration/boundary/audit/etc...

In general, I would hope that the security testing performed is matching up with what the security audit will be targeting. Usually, an audit is there to certify approval and maintain consistency with regards to security. You don't want to let security be approved once and then get lax, so they periodically audit security to ensure that proper patching and upgrades have taken place to keep the system/application secure.

The terms of your question are generic, if you have more specific terms like penetration testing, vulnerability assessment, various other approved certifications on application security then the nuances of those differences could be called out.

Improve this answer
0
0

Security Testing 1.Security testing is a process intended to reveal flaws in the security mechanisms of an information system that protect data and maintain functionality as intended.

Security Audit:

  1. A computer security audit is a manual or systematic measurable technical assessment of a system or application. Manual assessments include interviewing staff, performing security vulnerability scans, reviewing application and operating system access controls, and analyzing physical access to the systems.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.