Security testing methodology

Understand how authorised assessments are structured.

📖 Key ideas

Vulnerability assessment finds and ranks weaknesses.
Penetration testing (authorised) checks if weaknesses can be exploited, under strict scope.
Phases: planning, information gathering, assessment, reporting, re-testing.
Testing types: black box, grey box, white box.
The report with clear fixes is the main deliverable.

💡 Real-life example: A security assessment is a health check-up: tests, diagnosis report and a treatment plan.

Vulnerability assessmentFinding and ranking weaknesses

Penetration testAuthorised simulated attack

Black boxTester has no internal knowledge

ReportFindings with risk and remediation