A company is concerned about insider threats and wants to perform a security assessment. The lead security engineer has identified business-critical applications about half of which are homegrown…

Question

Options

• APerform an outside black-box penetration test
• BPerform social engineering against the application owners
• CPerform code review of the code base of these applications
• DPerform a white-box test by penetration testers

• A
  81% (25)
• B
  10% (3)
• C
  6% (2)
• D
  3% (1)

Explanation

A black-box penetration test simulates a real-world attacker with zero prior knowledge of the target systems. This provides the most objective view of what any attacker - including a malicious insider acting externally - could discover and exploit. For business-critical applications (including homegrown ones), this approach reveals the actual external attack surface without assumptions or insider bias. Option B (social engineering) targets human behavior, not application security. Option C (code review) is valuable for finding logic flaws in homegrown apps but does not assess runtime security posture or network-level exposure. Option D (white-box) is the most common choice when specifically simulating insider knowledge, but the question asks for the BEST overall assessment method for the stated concern - an unbiased external view of the attack surface.

No community discussion yet for this question.