Definition

Testing whether the system meets its specified security objectives.

[Source: BCS]

Comment

Weak points of the infrastructure and system are identified. Remedial action can then be taken to address these areas. To test that a system meets its security objectives, these need to be defined in.

The costs to a system (web based especially) that has weaknesses in its security can be extreme. The client of the system may not only lose their order/money, but they will also have lost their confidence in the system and the likelihood they will trust it again. As with all faults, security vulnerabilities are cheaper to fix the earlier that they are found.