Software Quality Assurance Forums: Security Testing: how to start and plan

Hi shark,

One suggestion from my side is keep this skill as additional to existing skill.For Security Testing u need to put more effort to know the technologies.
- Analysis of the application
This is common to every testing activity.Here only change is u need to concentrate on negative requirements.
- Determine the technologies used.
u need to understand the controls,validation process and configuration of the technologies(here we need developer help more).
- How many layers?
it depends on the application.Generally cliens,webserver,application server and database.
- Determine at what stage of SDLC now.
It depends on the criticality of the application.suppose for the applications like banking and finance we need to start from early stages.generally after functional testing we start the security testing.
- Examine what techniques can be applied
we can follow Threat modeling..
- Manual research and interviews.
It comes with exp..
- Threat modeling.
Threat modeling follows diff phases like
1) understand the application
2)split the application
3)identify the vulnerabilities
4)map the vulnerabilities to risks
5)do the penetration testing
6)analysis and reporting
- Review source.
it completely developers work.
- Penetration test.
execute the identified vulnerabilities

Best of luck for your future as a security tester