Security Testing
What is Security Testing?
The process of evaluating the security of systems, applications, and networks through various testing methodologies to identify vulnerabilities.
Terms that appear alongside security testing
Each of these is named in at least one of the same controls as security testing. The number is how many controls name both.
- application security testing 14 shared controls
- application security 14 shared controls
- information security 13 shared controls
- secure coding 11 shared controls
- penetration testing 10 shared controls
- encryption 10 shared controls
- owasp 9 shared controls
- code review 8 shared controls
Frameworks that govern security testing
What the standards actually require on security testing
Requirements naming security testing across 6 standards, quoted from the control text.
The security assessor confirms that integration testing and vulnerability assessment meet the assurance requirements and issues a statement of assessment.
canada-itsg-33-it-security-risk-management::A2-3.8.3 · 3.8.3 Assess integration security testing →The responsibilities for carrying out each activity in Requirement 11 must be written down, allocated to named roles or people, and understood by those people.
11.1.2 · 11.1.2 Roles for security testing assigned and understood →Security Testing. Security testing tools (DAST/IAST) are integrated into the pipeline so applications are tested as they are built.
ST1.4 · Integrate opportunistic security testing into the pipeline →Security testing processes are to be defined and carried out within the development life cycle. Purpose: check that code and applications satisfy their security requirements by the time they reach production.
iso-27002-2022::8.29 · Security testing in development and acceptance →Agencies should test gateway security measures at random intervals, with no more than six months between tests.
new-zealand-information-security-manual-nzism::19.1.23.C.01 · 19.1.23.C.01 Random gateway security testing at most six months apart →Software security testing takes place during the development lifecycle, using the methods the SDLC documentation describes. The assessor reads the testing procedures, inspects results and talks to the people who run the tests.
pci-3ds-core-security-standard::P1-3.1.4 · P1-3.1.4 Security testing during development using documented methods →Questions people ask about security testing
What is Security Testing?
Why is Security Testing important for compliance?
Which compliance frameworks address Security Testing?
Where can I learn more about Security Testing?
See how Security Testing applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.