Courses

Where feasible, project managers and systems architects may prefer the use of products evaluated under the international Common Criteria (CC) to satisfy system security requirements. Otherwise, certifiers and accreditors will need different evidence that an IT system, as implemented, meets security requirements defined in the system security policy. This course explores practical alternatives for security testing and evaluation to achieve the necessary levels of assurance.

• Examine the rationale for security testing and evaluation
• Develop an IT security test plan
• Select appropriate IT security test procedures, including:
• functional testing
• system integration testing
• stress testing
• vulnerability analysis
• other techniques
• Consider Onsite Technical Vulnerability Assessment (OTVA) and Active Network Security Testing (ANST) team services
• Assess test results

Recommended preparation: Course S51 - Threat and Risk Assessment (TRA): Practical Risk Management in a Hostile Environment, or equivalent.