What is Security Testing? Example
Thomas Hamilton
⚡ Smart Summary
Security Testing is a software testing discipline that uncovers vulnerabilities, threats, and risks in an application before attackers do. This article covers the seven core types, the SDLC integration model, common methodologies, key roles, and top tools.
What is Security Testing?
Security Testing is a type of software testing that uncovers vulnerabilities, threats, and risks in an application and prevents malicious attacks from intruders. The purpose of security tests is to identify every loophole and weakness in the system that could lead to a loss of information, revenue, or reputation at the hands of insiders or outsiders.
Why is Security Testing Important?
The main goal of security testing is to identify threats in the system and measure their potential impact so that the threats can be mitigated and the system continues to function safely. Security tests detect every possible risk and give developers actionable information to fix the issues in code before deployment.
Types of Security Testing in Software Testing
According to the Open Source Security Testing Methodology Manual (OSSTMM), there are seven primary types of security testing.
- Vulnerability Scanning: Automated software scans a system against known vulnerability signatures.
- Security Scanning: Identifies network and system weaknesses and recommends fixes. Can be manual, automated, or both.
- Penetration Testing: Simulates a malicious attack to uncover vulnerabilities an external attacker could exploit.
- Risk Assessment: Analyses security risks observed in the organisation and classifies them as Low, Medium, or High, recommending controls.
- Security Auditing: An internal inspection of applications and operating systems for security flaws. Can include line-by-line code review.
- Ethical Hacking: Authorised hacking of an organisation’s software to expose security flaws — the opposite intent of malicious hackers.
- Posture Assessment: Combines security scanning, ethical hacking, and risk assessment to show the overall security posture of an organisation.
How to Do Security Testing
It is widely accepted that the cost of fixing a security defect rises dramatically the later it is found. Postponing security testing until after deployment is far more expensive than embedding it into the SDLC from the start.
The table below maps security activities to every SDLC phase.
| SDLC Phase | Security Processes |
|---|---|
| Requirements | Security analysis of requirements and review of abuse / misuse cases. |
| Design | Security risk analysis for the design. Development of a test plan that includes security tests. |
| Coding and Unit Testing | Static and dynamic testing plus security white-box testing. |
| Integration Testing | Black-box testing. |
| System Testing | Black-box testing and vulnerability scanning. |
| Implementation | Penetration testing and vulnerability scanning. |
| Support | Impact analysis of patches. |
The security test plan should include:
- Security-related test cases and scenarios.
- Test data designed for security testing.
- Test tools required for each security activity.
- Analysis of outputs from the various security tools.
Example Test Scenarios for Security Testing
The list below offers a glimpse of typical security test cases.
- Passwords are stored in encrypted form, never in plain text.
- The application or system blocks invalid users.
- Cookies and session timeouts are validated for every workflow.
- For financial sites, the browser back button must not expose protected pages after logout.
Methodologies and Techniques for Security Testing
Security testing follows several established methodologies.
- Tiger Box: Testing performed from a laptop loaded with multiple operating systems and hacking tools. Used by penetration testers to assess vulnerabilities and run attacks.
- Black Box: The tester has no internal knowledge of the network topology or technology stack and probes the system as an outsider would.
- Grey Box: The tester receives partial information about the system. This hybrid of white-box and black-box techniques mirrors a realistic threat model where some details have leaked.
Security Testing Roles
- Hacker: Generic term for someone who accesses a computer system or network — commonly used today to refer to black-hat hackers who do so without authorisation.
- Cracker: Breaks into systems to steal or destroy data.
- Ethical Hacker: Performs the same activities as a hacker but with the owner’s explicit permission, helping to harden the system.
- Script Kiddies / Packet Monkeys: Inexperienced attackers with limited programming knowledge who rely on pre-built scripts and tools.
Security Testing Tools
1) Teramind
Teramind delivers a comprehensive suite for insider threat prevention and employee monitoring. It enhances security through behaviour analytics and data loss prevention, ensuring compliance and optimising business processes. Its customisable platform suits various organisational needs, providing actionable insights that focus on boosting productivity and safeguarding data integrity.
Features:
- Insider Threat Prevention: Detects and prevents user actions that may indicate insider threats to data.
- Business Process Optimisation: Uses data-driven behaviour analytics to refine operational processes.
- Workforce Productivity: Monitors productivity, security, and compliance behaviours.
- Compliance Management: Handles compliance from one scalable solution, suitable for small businesses, enterprises, and government agencies.
- Incident Forensics: Provides evidence to enrich incident response, investigation, and threat intelligence.
- Data Loss Prevention: Monitors and protects against the loss of sensitive data.
- Employee Monitoring: Tracks employee performance and activities.
- Behavioural Analytics: Analyses granular user app behaviour data for insights.
- Customisable Monitoring Settings: Allows monitoring rules to fit specific use cases.
- Dashboard Insights: Provides visibility and actionable insights through a comprehensive dashboard.
2) OWASP
The Open Web Application Security Project (OWASP) is a worldwide non-profit dedicated to improving software security. The project ships multiple tools for pen-testing different software environments and protocols. Flagship tools include:
- Zed Attack Proxy (ZAP) — an integrated penetration testing tool.
- OWASP Dependency-Check — scans project dependencies against known vulnerabilities.
- OWASP Web Testing Environment Project — a curated collection of security tools and documentation.
3) Wireshark
Wireshark is a network analysis tool previously known as Ethereal. It captures packets in real time and displays them in human-readable format. Wireshark is open source and runs on Linux, Windows, macOS, Solaris, NetBSD, FreeBSD, and many other systems. Data can be viewed in a GUI or through the TShark command-line utility.
4) w3af
w3af is a web application attack and audit framework. It has three plug-in categories — discovery, audit, and attack — that communicate with each other. A discovery plug-in looks for URLs to test, forwards them to the audit plug-in, which scans for vulnerabilities, and the attack plug-in then attempts exploitation.
Myths and Facts of Security Testing
Several persistent myths slow down security programmes. The list below pairs each myth with the underlying fact.
Myth #1: A small business does not need a security policy.
Fact: Every person and every company needs a security policy.
Myth #2: Security testing offers no return on investment.
Fact: Security testing surfaces areas for improvement that boost efficiency, reduce downtime, and enable maximum throughput.
Myth #3: The only way to be secure is to unplug the system.
Fact: Practical security comes from a posture assessment aligned with business, legal, and industry requirements — not from disconnecting the network.
Myth #4: Buying more software or hardware will safeguard the business.
Fact: Tools do not replace strategy. Understand the threat landscape first, then choose the controls that fit.
