Page 12 - Cyber Warnings

This approach is used for developing and testing security tools and techniques, as well as for
customers who want to evaluate those tools before purchasing them for their own networks.

Application compliance assessment

Compliance assessment is very similar to cyber tools testing except that the tools remain
fixed and new applications or hardware are inserted into the network, or existing
infrastructure is upgraded.

Testing with load, traffic and disruptive events is performed to determine whether the
new application, hardware, or upgrade might create a new vulnerability in the production
environment.

That includes privacy and data protection regulations, security requirements, and any
other business compliance standards that the organization is subject to. This testing is
performed prior to pushing any new upgrade, application or equipment into production to
ensure that compliance requirements will be maintained.

Performance based assessment – training

Security testing for training purposes is common with cyber ranges, but also for
corporate security testing. This type of testing allows organizations to train their
infrastructure and security administrators to respond in real time to a variety of security
threats. The focus of training is to train, practice, and
measure the performance of an organization’s
“When financial security team.

services firms were

asked how well Common Security Testing Problems

security testing All of the above types of security testing share some
common problems that make this type of testing
represents their real uniquely difficult and in many cases, much harder to
perform than other hardware and software testing.
production IT For example:

infrastructure, they  The tests must run in a configuration that
exactly matches the current production

really had no idea.” configurations.

One of the common characteristics of all of the
different security/cyber testing examples above is the
need to create an environment for testing that mimics the production environment as
accurately as possible (i.e. with high fidelity). This includes creating a clone of the
network configuration as well as simulating the traffic and load on that network.

12 Cyber Warnings E-Magazine – February 2016 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide