Security Testing
Security Testing is a type of software testing that uncovers vulnerabilities, threats, and risks in a software application. Its purpose is to identify and fix security weaknesses to protect the system from malicious attacks, ensuring data confidentiality, integrity, and availability.
First used·1970s
Definitions·1
Synonyms·3
Category·Software Testing
Also known as
Definitions
What it means.
- 01
Security Testing in Software Development
In the context of software development, Security Testing is a type of non-functional testing that aims to uncover vulnerabilities, threats, and risks in a software application. Its primary goal is to identify and fix security weaknesses that could be exploited by an attacker, thereby protecting the system from unauthorized access, data loss, or other malicious activities.
This process ensures the confidentiality, integrity, availability, and authentication of the system's data and functions. It is not a single activity but a collection of methodologies and practices applied throughout the Software Development Lifecycle (SDLC).
Key Methodologies:
- Vulnerability Scanning: Utilizes automated tools to scan a system against known vulnerability signatures.
- Penetration Testing (Pen Testing): A simulated cyberattack against a computer system to check for exploitable vulnerabilities. This is an active and offensive approach.
- Risk Assessment: Involves identifying security risks, analyzing their potential impact, and prioritizing them for mitigation.
- Security Auditing: A systematic, measurable technical assessment of a system or application's security posture, often against a checklist or standard.
- Ethical Hacking: A broad term encompassing a range of approved, offensive techniques to proactively find and fix security flaws before malicious hackers can.
Common Approaches:
- Static Application Security Testing (SAST): Analyzes an application's source code or binaries from the inside out, without executing the code. It's effective for finding flaws like SQL injection or buffer overflows early in development.
- Dynamic Application Security Testing (DAST): Tests a running application from the outside in, simulating attacks to find vulnerabilities in its interfaces and responses.
- Interactive Application Security Testing (IAST): A hybrid approach that combines elements of SAST and DAST, using agents to analyze an application's behavior and data flow as it runs.
Origin
Where it comes from.
Etymology
The term is a compound of 'Security' and 'Testing'. 'Security' originates from the Latin 'securitas', meaning 'freedom from care or danger'. 'Testing' comes from the Old French 'test', a vessel used in alchemy, derived from the Latin 'testum', meaning 'earthen pot', which was used to assay precious metals. The combined term signifies the process of assaying or examining a system for its freedom from danger.
Historical context
The concept of Security Testing evolved alongside the history of computing and networking. In the early days of mainframe computing (1960s-1970s), security was primarily physical. The focus was on controlling access to the computer room. The 1970 Ware Report for the ARPA (now DARPA) was a seminal work that highlighted the need for computer security in networked systems, laying the groundwork for future testing principles.
The proliferation of personal computers and the rise of the internet in the 1980s and 1990s brought new threats like viruses and worms, such as the infamous Morris Worm of 1988. During this era, security testing was often reactive, performed by system administrators in response to an incident. The term penetration testing gained popularity as a way to proactively find weaknesses.
The dot-com boom and the rise of web applications in the early 2000s shifted the focus to application-level security. The founding of the Open Web Application Security Project (OWASP) in 2001 was a major milestone. OWASP provided resources and standardized the language around web vulnerabilities with its famous 'OWASP Top 10' list, giving testers a clear framework.
From the 2010s to the present, the rise of Agile, DevOps, and cloud computing has led to the 'Shift Left' movement and the emergence of DevSecOps. This modern approach integrates automated and continuous Security Testing directly into the development pipeline, making security a shared responsibility rather than a final gate before release.
Usage
In context.
Our CI/CD pipeline now includes automated Security Testing to catch vulnerabilities before they reach production.
The compliance team mandated a full Security Analysis of the new payment gateway before its launch.
As part of our quarterly Security Testing cycle, we perform a comprehensive Penetration Test on our external-facing infrastructure.
Implementing a robust Application Security Testing (AST) program is essential for protecting customer data and meeting regulatory requirements.
FAQ
Common questions.
While often used interchangeably, they are different. Security Testing is a broad umbrella term for all practices intended to find and fix security flaws in a system. It includes a wide range of activities like vulnerability scanning, security audits, and risk assessments.
Penetration Testing (or pen testing) is a specific, offensive type of security testing where a tester simulates a real-world cyberattack to actively exploit vulnerabilities. Think of security testing as the entire field of checking for weaknesses, and penetration testing as one specific, hands-on technique within that field.
Taxonomy
Filed under.
Categories
Tags