Control PenetrationTesting

A device that can store, process, transmit or receive data.

Represents a process (usually implemented by software running on a Host) that can read, update or create data, or exchange data with other processes.

The software and hardware at device Host has been tested and certified to be secure by independent experts. The device is unlikely to contain exploitable bugs, though the assessment may become outdated so should be renewed from time to time. Note that this does not prevent bugs that are present being discovered and exploited by attackers, so it is a prior mitigation only which is ignored in current (run-time) risk calculations.

The software for process Process has been tested and certified to be secure by independent experts. The process is unlikely to contain exploitable bugs, though the assessment may become outdated so should be renewed from time to time. Note that this does not prevent bugs that are present being discovered and exploited by attackers, so it is a prior mitigation only which is ignored in current (run-time) risk calculations.