A truly comprehensive test of security would require penetration testing, yes, but would also test to see whether each user role (e.g. administrator) could only do the things they're supposed to do, instead of (for example) hoovering up every visitor's credit card numbers, genetic fingerprint and preferred sexual position.
( argyleblanket The man on the roof works for me, Fri 14 Oct 2011, 21:35, 1 reply)

Then they should use each person's logon with them sitting there.
Rule number one is you never give out a privileged password. I used to work as an admin and the only way I'd knowingly allow someone to test my access would be to check it whilst I watched.
I suppose another way to do it is to change the passwords of the affected accounts to ones known by the auditors for a brief window for testing and change them back afterwards. This, however, would require an air-tight contract to protect both the company concerned and the auditors.
(Me, I'm not... in any way intoxicated, Sat 15 Oct 2011, 0:12, closed)

You're right about both.
Temporary passwords and sitting over the shoulder.

Truth be told, that type of testing should first take place in a sandboxed environment with test (not production) data.
( argyleblanket The man on the roof works for me, Sat 15 Oct 2011, 0:23, closed)