CGRC · Question #234
If a "war-stopper" is found; testing should be immediately halted until the issue is resolved; what is a war-stopper? Response:
The correct answer is A. Evidence of criminal activity. In the context of security testing or auditing, a "war-stopper" refers to a critical finding that necessitates an immediate halt to ongoing activities until it is resolved. The most severe type of finding that would cause such an immediate halt is evidence of criminal activity.
Question
If a "war-stopper" is found; testing should be immediately halted until the issue is resolved; what is a war-stopper? Response:
Options
- AEvidence of criminal activity
- BEvidence of air strike activity
- CEvidence of non-criminal activity
- DNone of these
How the community answered
(61 responses)- A89% (54)
- B2% (1)
- C7% (4)
- D3% (2)
Why each option
In the context of security testing or auditing, a "war-stopper" refers to a critical finding that necessitates an immediate halt to ongoing activities until it is resolved. The most severe type of finding that would cause such an immediate halt is evidence of criminal activity.
In penetration testing or security assessments, a "war-stopper" is a severe finding that requires immediate cessation of testing. Evidence of criminal activity, such as discovering child pornography or active insider threats, is universally considered a war-stopper due to legal and ethical obligations.
'Evidence of air strike activity' is irrelevant to the context of IT security testing and auditing.
'Evidence of non-criminal activity' implies normal or acceptable behavior and would not halt a security test.
This choice is incorrect because A is a valid definition for a war-stopper in this context.
Concept tested: Penetration testing war-stopper definition
Source: https://www.sans.org/blog/how-do-you-handle-a-war-stopper-during-a-penetration-test/
Topics
Community Discussion
No community discussion yet for this question.