I had this couple of threads in here which talks about security assessment v/s risk assessments, but here the idea is completely different. Suppose, I had to breakdown qualitative tasks from the quantative ones, I would end up breaking these.
I came up with this model and was wondering if I am on the right path to understand them more better. Here's my model:
- I break up the 'security' into two - quantitative analysis and qualitative analysis
- I again break them into specific tasks which I found via the WWW
So in particular, the first segment i.e: 'security assessment' fits more to the quantitative tasks and 'security engagements' fill up more towards qualitative task. This is how I look at it now:
Security Assessment
- Risk Assessment
- Threat Assessment
- Security Compliances
Security Engagement
- Code Review
- Vulnerability Assessments
- Penetration Testing
- Red Team Enagagements
The first pointer has all the assessments and compliances compiled up and the second one is more of defensive + offensive approaches taken to 'quality' test the risks accessed in the first pointer. The defensive ones are code review and vulnerability assessments since the organization is taking up the engagement from teh defensive viewpoint and the latter two are offensive since it's challenging an auditor to find loopholes, break-through and actually exploit.
My question at this point is all of this concept is true or I have been missing on something since there are lot of more terms!?