nerdexam
EC-Council

312-50V9 · Question #417

When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is

The correct answer is D. OSSTMM addresses controls and OWASP does not. The core distinction is that OSSTMM quantifies operational security controls and measures the attack surface, while OWASP focuses on identifying web application vulnerabilities without a controls-measurement framework.

Introduction to Ethical Hacking

Question

When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is

Options

  • AOWASP is for web applications and OSSTMM does not include web applications.
  • BOSSTMM is gray box testing and OWASP is black box testing.
  • COWASP addresses controls and OSSTMM does not.
  • DOSSTMM addresses controls and OWASP does not.

How the community answered

(32 responses)
  • A
    3% (1)
  • B
    9% (3)
  • C
    3% (1)
  • D
    84% (27)

Why each option

The core distinction is that OSSTMM quantifies operational security controls and measures the attack surface, while OWASP focuses on identifying web application vulnerabilities without a controls-measurement framework.

AOWASP is for web applications and OSSTMM does not include web applications.

OSSTMM does cover web application testing as part of its broad operational security scope; it is not limited to non-web environments.

BOSSTMM is gray box testing and OWASP is black box testing.

Neither methodology is strictly constrained to gray box or black box testing; both can be applied across multiple testing contexts depending on the engagement.

COWASP addresses controls and OSSTMM does not.

This reverses the correct relationship - it is OSSTMM, not OWASP, that provides the formalized controls framework through its RAV scoring system.

DOSSTMM addresses controls and OWASP does not.Correct

OSSTMM uses a formal Risk Assessment Value (RAV) model that explicitly measures security controls - such as separation, visibility, and trust - to quantify an organization's actual security posture. OWASP's testing guide is vulnerability-centric and provides checklists and techniques for finding flaws in web applications, but it does not include a comparable controls-measurement framework.

Concept tested: OWASP vs OSSTMM methodology differences

Source: https://www.isecom.org/OSSTMM.3.pdf

Topics

#OWASP#OSSTMM#testing methodology#security controls

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice