CompTIA Security+ Preparation · lesson 40 of 45 · 25 min
Types of Security Assessments
Vulnerability assessment — identifies and prioritizes vulnerabilities. Does NOT exploit them. Automated scanning + manual review. Output: prioritized list of vulnerabilities with CVSS scores.
Penetration test — actively exploits vulnerabilities to demonstrate real impact. Authorized simulated attack. Output: findings with proof-of-concept exploits and remediation recommendations.
Security audit — systematic evaluation of security controls against a standard or policy. Checks compliance. Can be internal (self-assessment) or external (third-party). Output: audit report with findings and compliance status.
Risk assessment — identifies threats, vulnerabilities, and their potential business impact. Quantitative (dollar values) or qualitative (High/Medium/Low). Output: risk register with prioritized risks.
Red team exercise — full-scope adversary simulation. Red team (attackers) vs Blue team (defenders). Tests people, processes, and technology. More comprehensive than a pen test.
Purple team — red and blue teams work together. Red team attacks while blue team observes and improves detections in real time.
Audit Standards and Compliance
SOC 2 — Service Organization Control 2. Audits cloud service providers on Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy. Type 1: point-in-time. Type 2: over a period (6–12 months).
ISO 27001 — international standard for Information Security Management Systems (ISMS). Certification requires implementing controls from Annex A and passing an external audit.
PCI-DSS — Payment Card Industry Data Security Standard. Required for organizations that process, store, or transmit cardholder data. Annual assessment by a Qualified Security Assessor (QSA).
HIPAA Security Rule — requires healthcare organizations to implement administrative, physical, and technical safeguards for electronic Protected Health Information (ePHI).
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Security Audits & Assessments
A vulnerability assessment differs from a penetration test because:
- Vulnerability assessments are more expensive
- Vulnerability assessments identify vulnerabilities without exploiting them
- Penetration tests are automated
- They are identical
- Answer: Vulnerability assessments identify vulnerabilities without exploiting them
Vulnerability assessments find and prioritize vulnerabilities. Pen tests actively exploit them to demonstrate real impact. A red team exercise tests:
- Only technical controls
- People, processes, and technology through full adversary simulation
- Only network security
- Only application security
- Answer: People, processes, and technology through full adversary simulation
Red team exercises are comprehensive — they test the entire security program, including human responses and detection capabilities. SOC 2 Type 2 differs from Type 1 because:
- Type 2 is more expensive
- Type 2 evaluates controls over a period (6–12 months); Type 1 is point-in-time
- Type 1 is more rigorous
- They cover different industries
- Answer: Type 2 evaluates controls over a period (6–12 months); Type 1 is point-in-time
SOC 2 Type 2 is more valuable — it demonstrates that controls were operating effectively over time, not just at one moment. PCI-DSS applies to organizations that:
- Use cloud services
- Process, store, or transmit cardholder data
- Have more than 100 employees
- Operate in the US only
- Answer: Process, store, or transmit cardholder data
PCI-DSS applies to any organization that handles payment card data — regardless of size or location. A purple team exercise involves:
- Red team attacking without blue team knowledge
- Red and blue teams working together to improve detections in real time
- Only blue team defensive exercises
- External auditors only
- Answer: Red and blue teams working together to improve detections in real time
Purple teaming is collaborative — red attacks while blue observes, improving detection rules and response procedures together. ISO 27001 certification requires:
- Only a self-assessment
- Implementing ISMS controls and passing an external audit
- Only technical controls
- Annual penetration testing
- Answer: Implementing ISMS controls and passing an external audit
ISO 27001 certification requires implementing an ISMS with Annex A controls and passing a formal external audit by an accredited body. A risk assessment output is:
- A list of open ports
- A risk register with prioritized risks and their business impact
- A list of CVEs
- A compliance checklist
- Answer: A risk register with prioritized risks and their business impact
Risk assessments produce a risk register — threats, vulnerabilities, likelihood, impact, and risk treatment decisions. HIPAA Security Rule protects:
- Payment card data
- Electronic Protected Health Information (ePHI)
- Government classified data
- Financial records
- Answer: Electronic Protected Health Information (ePHI)
HIPAA Security Rule requires healthcare organizations to protect ePHI through administrative, physical, and technical safeguards. An internal security audit is conducted by:
- External auditors only
- The organization’s own security team (self-assessment)
- Government regulators
- Customers
- Answer: The organization’s own security team (self-assessment)
Internal audits are self-assessments — valuable for continuous improvement. External audits provide independent verification.
A QSA (Qualified Security Assessor) conducts _____ assessments.
Answer: PCI-DSS
QSAs are certified by the PCI Security Standards Council to conduct formal PCI-DSS compliance assessments.
Previous lesson: Compliance and regulations: GDPR, HIPAA, PCI-DSS, SOX
Back to CompTIA Security+ Preparation
Next lesson: Business impact analysis (BIA): RTO, RPO, MTBF, MTTR, critical assets