Technical Guide to Information Security Testing and Assessment

Scarfone, K., Souppaya, M., Cody, A., & Orebaugh, A. (2008). Technical Guide to Information Security Testing and Assessment. National Institute of Standards and Technology.

Type

Report

Intellectual base

Grey literature

Year

2008

DOI

10.6028/nist.sp.800-115

DOI registrant

National Institute of Standards and Technology

Link

https://doi.org/10.6028/NIST.SP.800-115

Cited by

3 citations across 3 artifacts.

Each citation links to the sentence it supports in the citing article.

Mechanisms

• Material-Divergence Red Team
  • Its strength is finding the failure the compliance-style checks miss — the summary that is technically true and still misleads — by simulating the adversary before the adversary arrives
• Red-Team Stress Test
  • Those findings become the security team's remediation backlog — a to-do list written by someone who actually broke in.

    This sourceTechnical security-test findings should be analyzed, prioritized, and converted into mitigation actions.

• Transitive Vulnerability Scan
  • A clean scan means "no matches in today's databases," not "no vulnerabilities"

    This sourceDefines vulnerability scanning as matching discovered system details against known-vulnerability databases and signatures, a scope that does not warrant an all-clear inference.

Verification

Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.

Does it back the claim? Not recorded. Neither this nor any other of the 3 citations of this work carries a recorded support check.

Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.

See how references were verified.

Registry ID ref:29c4242b94c7 · see in the full table