Software Security Auditing

Updates for this SFS are pending because supporting source research is incomplete. Existing catalog content is shown.

This set covers vulnerability assessment, penetration testing, black-box and white-box review, and security testing of applications and services. Questions should identify the tested version, system boundary, procedure, evidence period, and criterion for accepting a finding or remediation. Reports and retest results support individual judgments; the presence of an auditing tool alone does not demonstrate effectiveness. Development practices belong to SFS 8, delivery records to SFS 7, and live incident monitoring to SFS 6.

• SF 0
• SF 1
• SF 2
• SF 3
• SF 4
• SF 5
• SF 6
• SF 7
• SF 8
• SF 9
• SF A
• SF B
• SF C
• SF D
• SF E
• SF F