Unit
- Security testing: A process that evaluates systems, networks, and applications for vulnerabilities, misconfigurations, and weaknesses that could lead to unauthorized access, data loss, or service disruption. It differs from functional testing by focusing on what should not happen rather than verifying intended behavior.
- Common goals: Identify threats, measure potential impact, verify compliance with standards like ISO 27001 or OWASP, and provide actionable remediation guidance. Testing is performed throughout the software development lifecycle (SDLC) to catch issues early when fixes are cheaper.
- Key roles: Security testers, penetration testers, secure code reviewers, and DevSecOps engineers collaborate with developers and operations. Each brings a specialized perspective, from code analysis to network exploitation.
- Testing vs. auditing: Security testing is proactive and hands-on, while auditing often reviews policies and past events. Both are necessary for a mature security program.
- Types of testing: Includes vulnerability scanning, penetration testing, code review, architecture analysis, and red team exercises. Each method has different depth, cost, and timing in the SDLC.
- Standards and frameworks: OWASP Testing Guide, NIST SP 800-115, PTES, and OSSTMM provide structured methodologies. Many organizations adopt a hybrid approach tailored to their risk profile.
- Ethics and legality: Security testing must be authorized in writing, with defined scope and rules of engagement. Unauthorized testing can lead to legal consequences and is never condoned.
- Business value: Early vulnerability detection reduces breach costs, protects brand reputation, and supports compliance with regulations like GDPR or PCI DSS. A single critical bug fixed pre-release can save millions versus post-incident response.
Security Consideration
MEDIUM RISK
Vulnerability: Authorization creep in testing tools that retain access to production systems after testing concludes.
Mitigation: Use dedicated test accounts that expire automatically, and revoke all credentials immediately after each test engagement.
Reference: OWASP Testing Guide v4
Quick Revision
- Security testing identifies vulnerabilities through proactive evaluation of systems, networks, and applications.
- It differs from functional testing by focusing on undesirable behaviors and failure scenarios.
- Standards like OWASP and NIST provide structured testing methodologies.
- Authorized testing with clear scope is essential for legal and ethical compliance.