What is the goal of the security testing phase, and what are its steps and pitfalls?
Show that the security controls work and stay intact once all components are integrated, and test the complete system for vulnerabilities, internally or externally. It ends with a security testing report and follow-up on every finding.
The Test Manager is responsible. It needs testable security requirements, the threat model, test infrastructure, tools and experts.
- Plan security testing: the security testing plan.
- Create test cases and the test setup.
- Support testing: integration and regression tests, vulnerability analysis and pentests.
- Write the testing report.
- Follow up on findings.
Good practice: internal functional and sanity testing first, so external pentesters don't spend their days on trivial bugs. Then involve externals and prefer white-box testing, which gives testers the design and code. Pitfalls: untested requirements, accepting failures, and no follow-up. A finding that is reported and never fixed was useless.
Go deeper:
OWASP Web Security Testing Guide — a structured catalogue of security test cases- Penetration test (Wikipedia) — white-, grey- and black-box testing compared