I am a bit confused by security audit and security testing, do they not both test against security holes?
What are the differences between them?
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It only takes a minute to sign up.Sign up to join this community
Differences between security audit and security testing
Security audit and security testing share something in common as well
A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be performed by a different group than those who write the software and the security tests that go with it.
Security testing is a constant on-going practice, ideally done for each change in the software as part of application development and/or as part of the code that handles security aspects such as authentication and authorization.
An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party doing that. Security testing could be for development/penetration/boundary/audit/etc...
In general, I would hope that the security testing performed is matching up with what the security audit will be targeting. Usually, an audit is there to certify approval and maintain consistency with regards to security. You don't want to let security be approved once and then get lax, so they periodically audit security to ensure that proper patching and upgrades have taken place to keep the system/application secure.
The terms of your question are generic, if you have more specific terms like penetration testing, vulnerability assessment, various other approved certifications on application security then the nuances of those differences could be called out.