The training is a module of the seminar series: Basics of Security Testing.
metamorworks stock
Security Testing Processes
Basics of Security Testing
The Challenge
Security requirements for modern IT systems are increasing and cannot be realised by constructive measures alone. More than 90 percent of all software security incidents are caused by attackers exploiting known security vulnerabilities. The majority of these are based on programming errors. By planning, monitoring, and executing systematic security testing processes, vulnerabilities can be comprehensively and traceably identified and remediated, and progress and completion can be measured and determined.
The Solution
The course teaches the general principles and structure of security testing processes. These are considered in the context of different application life cycle models. The concrete tasks in the different phases of the security testing process are analysed. Practical security tests are explained and carried out along the different phases. Some typical vulnerabilities and test methods are explained. The organisational framework conditions of security testing in the phases of the security testing process are also considered.
Your advantages at a glance
After the seminar you will be able to...
- Plan security testing processes and the activities in their phases
- Select and apply basic methods for the activities in the individual phases of the security testing process
- Understand security testing processes in different application lifecycle models
This seminar offers you...
- Systematic introduction to security testing processes
- Introduction to security testing techniques such as fuzzing and test evaluation
- Practical exercises for various activities in the phases of the security testing process such as planning, analysis, design, implementation, execution, and evaluation of security tests.
Contents
- Definition of security test processes
Learning objectives
After the course, participants will be able to select, plan, implement and analyse the most important activities for a systematic security process.
- Define the elements of an effective security testing process for a given project
- Analyse a given security test plan and identify its strengths and weaknesses
- Design of conceptual (abstract) security tests based on a given security testing approach and identified functional and structural security risks for a given project.
- Design of test cases for the validation of security policies and procedures
- Understanding the key elements and features of an effective security testing environment
- Understand the importance of planning and approval before conducting security tests
- Analysis of the results of security tests for reporting purposes
- Understanding the need to revise security expectations and acceptance criteria
- Understand the need to keep security test results confidential and secure
- Understand the need to establish appropriate data collection controls and mechanisms to provide source data for security test status reports in a timely, accurate and precise manner
- Analysis of a given interim report on the status of security testing to determine the level of accuracy, understandability, and appropriateness for stakeholders
Target group
Product managers, project managers in product development, product developers, requirements developers, test developers, test analysts, test managers, acceptance testers, quality managers and consultants
Requirements
Basics of software testing (e.g. ISQTB Certified Tester Foundation Level)
Course data
Specialists and user training
Level: Basic
Appointment: In-house seminar (by arrangement)
Duration: 1 day (6 hours)
Venue: Online or in person (Fraunhofer FOKUS, Kaiserin Augusta Alle 31, 10589 Berlin or other locations)
Number of participants: 5-12
Language: German or English (English teaching material)
Speakers: Martin Schneider und Dorian Knoblauch
Martin Schneider is team leader of the testing group in the Quality Engineering business unit of the Fraunhofer Institute FOKUS. He is an expert in quality assurance and security testing in the field of networked software systems.
Dorian Knoblauch is a research assistant in the Critical Systems Engineering group in the SQC business unit of the Fraunhofer Institute FOKUS.
golubovy/ iStock
Please contact us
Would you like individual advice or do you have any questions about our training courses? Give us a call or send us an e-mail. We will then get in touch with you.
Privacy enhancement for events related to our privacy policy
Privacy enhancement
Privacy enhancement for events related to our privacy policy
As part of the registration for “Security Testing Processes” we require the following compulsory information:
- Title,
- Last name, first name,
- Address,
- Email address,
- Cell phone,
- Course date.
Additionally you can provide us following optional information:
- Degree,
- Firm,
- Invoice address (if devergent),
- Position.
We collect the required data in order to identify you as participant of the event, to check the provided information for plausibility, to reserve a place for the participant in the event and to establish a contract with you. We also want to supply the participant with information during and after the event, offer the participant an optimal participation and allow us to plan and execute a smooth running event.
We need the payment data to collect the participation fees.
Collecting the voluntary information allows us to plan and conduct the event according to the interests of the participants in an age-appropriate fashion.
We process the data based on your enquiry and for the declared purposes as prescribed by Article 6 para. 1, page 1, lit. b GDPR to perform the contractual obligations toward the participants and meet the conditions precedent to entering into the contract.
We will store the personal data collected in context with the event until the end of the regular limitation period of three (3) years following the end of the year of the event. We will then delete the data unless we are obligated by law to store the data for a longer period according to compulsory safekeeping and documentation obligations pursuant to Article 6 para. 1, page 1 lit. c GDPR and in particular according to § 147 AO [General German Fiscal Code]) or unless you have agreed to a longer data storage according to Article 6 para. 1, page 1 lit. a GDPR. In case of longer data storage, we shall process the data solely to the extent mandated by law or according to your permission. As for all else, the further processing of the data shall be barred.
In the context with project registrations via Internet form, we work with our service provider Mailingwork GmbH, Birkenweg 7, 09569 Oederan, Deutschland (“Mailingwork”). The purpose of this collaboration is the professional management of online registrations to our projects. In the process, our service provider Mailingwork GmbH stores the provided data in Germany.
We entered into an order processing contract with Mailingwork GmbH. The purpose of the cooperation is the provision of project registration services. In this contract, Mailingwork GmbH agrees to process the data on our behalf in compliance with the General Data Protection Regulation (GDPR) and guarantees to comply with the rights of the affected persons. The general data protection regulations for the websites of the Mailingwork GmbH are available at: https://mailingwork.de/datenschutz/.
More About this Subject
Further modules from the seminar series 'Basics of Security Testing' are:
FOKUS at Twitter
FOKUS at Facebook
FOKUS at YouTube
FOKUS at LinkedIn
FOKUS at Xing
FOKUS at Mastodon