Security testing tools and techniques: vulnerability scanning, penetration testing and configuration review

Security testing finds weaknesses before attackers do and gives evidence about whether controls actually work. An auditor may perform some tests directly, rely on tests performed by others such as an internal security team or an external firm, or review the organization's own testing program. In every case, the questions are whether testing is risk-based, performed by qualified and suitably independent people, properly authorized, and followed by timely remediation.