5.5 Explain types and purposes of audits and assessments

Breakdown 1 — Attestation and audits

Attestation = a formal statement that controls exist and work (management attests; an auditor attests independently — SOC 2 report).

Type	Who	Examples
Internal	Your own staff	Compliance checks against policy; the audit committee (board-level oversight of audit function); self-assessments (questionnaires, control checklists)
External	Outside parties	Regulatory audits (HIPAA/PCI QSA); examinations (regulator inspections — banking); assessment (consultant gap assessment); independent third-party audit (SOC 2, ISO 27001 certification)

From class — security audit types: baseline review (does the build match the baseline? — PXE-deployed VM as an example), attack-surface review (what devices/types do we have exposed), design review, control review, procedure review.

Breakdown 2 — Penetration testing

Dimension	Options
Physical	Test doors, badges, tailgating, dumpster diving
Offensive	Red team attacks
Defensive	Blue team detection/response evaluated
Integrated	Purple — offense and defense together
Known environment (white box)	Tester gets full info — "give you all information" (class)
Partially known (gray box)	Some info (e.g., user credentials)
Unknown environment (black box)	No info — "none; get the whole picture" (class). ⚠ Class notes labeled this "white box"; CompTIA: unknown = black.
Reconnaissance — passive	No contact with target: OSINT, DNS, job postings
Reconnaissance — active	Touches the target: scans, banner grabbing, "making the phone calls" (class)

Process (class): Planning → Discovery → Attack → Reporting; rules of engagement define scope, timing, and what's off-limits; "do not mess up the system." Teams: red / blue / white / purple.

Breakdown 3 — Why each exists

• Self-assessment — cheap, frequent, catches drift; low independence.
• Internal audit — independence within the org; reports to the audit committee.
• External audit — required by regulators/customers; highest credibility.
• Pen test — proves exploitability, not just presence of a vuln (scan = passive/identify; pentest = active/exploit).

Exam tip: "Customer wants proof from an outside firm" → independent third-party audit. "Regulator shows up to inspect" → examination. "Testers given only the company name" → unknown environment. "Testers try to enter the building" → physical pen test. "Both teams collaborate in real time" → integrated/purple.

Quick self-check

• Passive vs. active recon?
• Known vs. unknown environment?
• Who does an internal audit report to? (Audit committee.)