Welcome to this course. When companies come together to work in an integrated manner, special care must be taken to ensure that each party promises to provide the necessary level of protection, liability, and responsibility, which should be clearly defined in the contracts each party signs. You can hire the best people, develop sound policies and procedures, and deploy worldclass technology in an effort to secure your information systems, but if you do not regularly assess the effectiveness of these measures, your organization will not be secure for long. Unfortunately, thousands of well-intentioned organizations have learned the truth of this statement the hard way, realizing only after a security breach has occurred that the state-of-the-art controls they put into place initially have become less effective over time. So unless your organization is continuously assessing and improving its security posture, that posture will become ineffective over time.

This course covers some of the most important elements of security assessments and testing. We start by discussing audit strategies, particularly the pros and cons of using our own internal auditors or bringing in external contractors. We then move on to approaches to testing our technical security controls. The third major section deals with testing our administrative controls, which are mostly implemented through polices. Finally, after we have enough empirical data to assess our posture, we discuss how to report our findings and how those findings play into the executive decision making within the organization.

In this course, you'll learn:

• Assessment and testing strategies

• Penetration Testing & Vulnerability Testing

• Testing security controls

• Security Control Testing Strategies

• Analyzing and reporting results