look at a specific control or compliance issue. Characterized by a narrow scope, this type of engagement could make use of any of the earlier approaches discussed (vulnerability assessment, security assessment, penetration test). Security Review - Verification that industry or internal security standards have been applied to system components or product. This is typically completed through gap analysis and utilizes build / code reviews or by reviewing design documents and architecture diagrams. This activity does not utilize any of the earlier approaches (Vulnerability Assessment, Security Assessment, Penetration Test, Security Audit) Tools Container and Infrastructure Security Analysis SAST - Static Application Security Testing DAST - Dynamic Application Security Testing IAST - Interactive Application Security Testing DLP - Data Loss Prevention IDS, IPS - Intrusion Detection System, Intrusion Prevention System OSS Scanning - Open Source Software Scanning (see Open-source software security) RASP - Runtime Application Self-Protection SCA - Software Composition Analysis WAF - Web Application Firewall See also National Information Assurance Glossary References Computer security Security testing