Duration
3 days
Course Objectives
- Plan, perform and evaluate security tests from a variety of perspectives
- Evaluate an existing security test suite and identify any additional security tests needed.
- Analyze a given set of security policies and procedures, along with security test results, to determine effectiveness.
- For a given project scenario, identify security test objectives based on functionality, technology attributes and known vulnerabilities.
- Analyze a given situation and determine which security testing approaches are most likely to succeed in that situation.
- Identify areas where additional or enhanced security testing may be needed.
- Evaluate effectiveness of security mechanisms.
- Help the organization build information security awareness.
- Demonstrate the attacker mentality by discovering key information about a target, performing actions on a test application in a protected environment that a malicious person would perform, and understand how evidence of the attack could be deleted.
- Analyze a given interim security test status report to determine the level of accuracy, understandability, and stakeholder appropriateness.
- Analyze and document security test needs to be addressed by one or more tools.
Course Outline
- 1. The Basis of Security Testing
- Security Risks
- Information Security Policies and Procedures
- Security Auditing and Its Role in Security Testing
- 2. Security Testing Purposes, Goals and Strategies
Introduction
- The purpose of Security Testing
- The organizational Context
- Security Testing objectives
- The scope and coverage of Security Testing objectives
- Security Testing approaches
- Improving the Security Testing practices
- 3. Security Testing Processes
- Security Test Process definition
- Security Test Planning
- Security Test Design
- Security Test Execution
- Security Test Evaluation
- Security Test Maintenance
- 4. Security Testing Throughout the Software Lifecycle
- Role of Security Testing in a Software Lifecycle
- The Role of Security Testing in Requirements
- The Role of Security Testing in Design
- The Role of Security Testing in implementation Activities
- The Role of Security Testing in System and Acceptance Test Activities
- The Role of Security Testing in Maintenance
- 5. Testing Security Mechanisms
- System Hardening
- Authentication and Authorization
- Encryption
- Firewalls and Network Zones
- Intrusion Detection
- Malware Scanning
- Data Obfuscation
- Training
- 6. Human Factors in Security Testing
- Understanding the Attackers
- Social Engineering
- Security Awareness
- 7. Security Test Evaluation and Reporting
- Security Test Evaluation
- Security Test Reporting
- 8. Security Testing Tools
- Types and Purposes of Security Testing Tools
- Tool Selection
- 9. Standard and Industry Trends
- Understanding Security Testing Standards
- Applying Security Standards
- Industry Trends
Programme scope, delivery arrangements and suitability are confirmed during enquiry.