Security Assessment & Testing

[cgye]

The purpose of this issue is to provide guidance on the following Security Assessment & Testing considerations. With the exception of Pen Testing, the actual assessment & testing activities are usually performed by the development & testing team.

• SAST
• Vulnerability Scanning (DAST, ideally automated)
• Vulnerability Assessment (typically reviewing findings from Vulnerability Scanning)
• Pen Testing (this would typically also involved both Vulnerability scanning & assessment)
• ATO