CAS-001 · Question #159
The Chief Information Security Officer (CISO) of a small bank wants to embed a monthly testing regiment into the security management plan specifically for the development area. The CISO's…
The correct answer is C. White box testing performed by the development and security assurance teams. White box testing (also called clear box or glass box testing) gives the tester full knowledge of the internal architecture, source code, logic, and design of the system being tested. This satisfies all CISO requirements: (1) Low risk to system stability - internal testers who…
Question
The Chief Information Security Officer (CISO) of a small bank wants to embed a monthly testing regiment into the security management plan specifically for the development area. The CISO's requirements are that testing must have a low risk of impacting system stability, can be scripted, and is very thorough. The development team claims that this will lead to a higher degree of test script maintenance and that it would be preferable if the testing was outsourced to a third party. The CISO still maintains that third-party testing would not be as thorough as the third party lacks the introspection of the development team. Which of the following will satisfy the CISO requirements?
Options
- AGrey box testing performed by a major external consulting firm who have signed a NDA
- BBlack box testing performed by a major external consulting firm who have signed a NDA
- CWhite box testing performed by the development and security assurance teams.
- DGrey box testing performed by the development and security assurance teams.
How the community answered
(49 responses)- A12% (6)
- B8% (4)
- C76% (37)
- D4% (2)
Explanation
White box testing (also called clear box or glass box testing) gives the tester full knowledge of the internal architecture, source code, logic, and design of the system being tested. This satisfies all CISO requirements: (1) Low risk to system stability - internal testers who know the system intimately can design tests that avoid destabilizing operations; (2) Scriptable - white box testing lends itself well to automated, repeatable test scripts since the code paths are known; (3) Very thorough - full code visibility allows testing of all branches, edge cases, and internal logic; (4) Performed internally - the development and security assurance teams possess the introspection the CISO values, addressing the concern that third parties lack system-specific knowledge. Grey box testing (options A and D) provides only partial knowledge. Black box testing (option B) provides no internal knowledge, limiting thoroughness. External consultants (options A and B) do not satisfy the CISO's introspection requirement.
Topics
Community Discussion
No community discussion yet for this question.