Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?

External penetration testing by a qualified third party is the most effective method for measuring the real-world effectiveness of perimeter security controls. This process simulates an attack by a skilled adversary, actively attempting to circumvent firewalls, intrusion prevention systems, and other defenses. Unlike automated scans or internal reviews, it tests how controls work together as a system against novel and complex attack techniques. The third-party perspective ensures objectivity and brings specialized expertise that may not exist internally, providing a realistic assessment of the perimeter's resilience.

A. A vulnerability scan is an automated tool that identifies known vulnerabilities but does not actively test the effectiveness of controls against a determined attacker.
C. Internal firewall ruleset reviews are a static analysis of configuration. They can identify misconfigurations but do not test the operational effectiveness of the controls under attack.
D. Implementing a network intrusion prevention system is an action to add a control, not a method to measure the effectiveness of existing controls.

1. National Institute of Standards and Technology (NIST). (2008). Special Publication 800-115: Technical Guide to Information Security Testing and Assessment. Section 5, "Security Assessment Techniques," describes penetration testing as a method to "simulate an attack on a system... to determine the level of effectiveness of the security controls."

2. Scarfone, K., & Mell, P. (2008). NIST Special Publication 800-42: Guideline on Network Security Testing. Section 3.3, "Penetration Testing," highlights its use for testing the security posture of a network from the perspective of an attacker.

3. Holm, H., & Typpö, V. (2021). Industrial-strength security strategies. Apress. Chapter 10, "Penetration Testing," explains that its purpose is to find out how effective security controls are by actively trying to break them.