Use caution when testing. Certain types of testing, including network scanning, vulnerability testing, and penetration testing, can mimic the signs of attack. It is imperative that testing be done in a coordinated manner, with the knowledge and consent of appropriate officials. Ensure that security policy accurately reflects the organization’s needs. The policy must be used as a baseline for comparison with testing results. Without appropriate policy, the usefulness of testing is drastically limited. For example, discovering that a firewall permits the flow of certain types of traffic may be irrelevant if there.
