Security Testing Methodologies

Security testing methodologies are systematic approaches or frameworks that guide the process of evaluating the security of a system, application, or network. These methodologies help identify vulnerabilities, weaknesses, and potential risks to implement effective security measures. Here are some widely recognized security testing methodologies:

1. OWASP Application Security Verification Standard (ASVS):

   

   • Overview: ASVS is a community-driven framework that establishes a security standard for web applications and services. It provides security controls and requirements across three levels (L1-L3) to guide the development and testing of web applications. OWASP Application Security Verification Standard (ASVS), which is indeed a project within the OWASP organization

   • Focus: Primarily for web application security.

   • Key Features: Detailed security controls, three security levels, technology-agnostic.

2. PTES (Penetration Testing Execution Standard):

   

   • Overview: PTES is a framework that defines a consistent and comprehensive approach to penetration testing. It guides testers through seven stages, from pre-engagement to reporting, ensuring a thorough and structured testing process.

   • Focus: Primarily for penetration testing and ethical hacking.

   • Key Features: Seven-stage methodology emphasizes targeted assessments and point-in-time assessment.

3. OSSTMM (Open Source Security Testing Methodology Manual):

   

   • Overview: OSSTMM is a manual that provides a holistic approach to security testing, covering technical, operational, and human security aspects. It emphasizes realistic testing scenarios and offers guidelines for security professionals.

   • Focus: Holistic security testing covering technical, operational, and human aspects.

   • Key Features: Realistic testing scenarios, comprehensive manual, diverse testing areas.

4. ISSAF (Information Systems Security Assessment Framework):

   

   • Overview: ISSAF is a framework designed to assist security professionals in conducting security assessments of information systems. It provides guidelines, tools, and methodologies for comprehensive security assessments.

   • Focus: Security assessments of information systems.

   • Key Features: Structured approach, covers reconnaissance to reporting, includes tools and techniques.

5. NIST (National Institute of Standards and Technology):

   

   • Overview: NIST SP 800-115 is a technical guide from the National Institute of Standards and Technology (NIST) that guides information security testing and assessment. It covers the planning, execution, and management of security testing activities.

   • Focus: Information security testing and assessment.

   • Key Features: Guidance for planning and executing security testing aligns with the NIST framework.

Difference between OWASP and OWASP (ASVS)

OWASP (Open Web Application Security Project):

• Definition: OWASP Top Ten is a nonprofit organization dedicated to improving the security of software. It was designed in 2003 to demonstrate applications’ key risks. It provides resources, tools, guidelines, and projects to help organizations and individuals develop, maintain, and operate secure software.

• Role: OWASP's role is to raise awareness about application security, provide educational resources, and offer tools and projects to assist in the secure development and testing of web applications. The OWASP Top Ten is updated periodically; the most recent version was released in 2021. The OWASP Top Ten includes the following risks:
  1. A01:2021-Broken Access Control
  2. A02:2021-Cryptographic Failures
  3. A03:2021-Injection
  4. A04:2021-Insecure Design
  5. A05:2021-Security Misconfiguration
  6. A06:2021-Vulnerable and Outdated Components
  7. A07:2021-Identification and Authentication Failures
  8. A08:2021-Software and Data Integrity Failures
  9. A09:2021-Security Logging and Monitoring Failures
  10. A10:2021-Server-Side Request Forgery

OWASP Application Security Verification Standard (ASVS):

• Definition: The OWASP ASVS is a specific project within the OWASP organization. It is a framework and a set of security controls that provide security requirements for web applications and web services. ASVS aims to standardize the security controls required during development and testing.

• Role: ASVS focuses on establishing a security standard for web applications by providing a structured set of security controls across three levels (L1-L3). It is used to guide developers and security professionals in implementing and testing security features in web applications.
  Level 1 (L1)  is designed for low assurance levels and is fully penetration-testable.
  Level 2 (L2)  is recommended for most apps and is for applications that include sensitive data that requires protection.
  Level 3 (L3) is intended for the most critical applications, such as those that handle high-value transactions, hold sensitive medical data, or require the highest level of trust.

Prev: Chapter 1

Next: Chapter 3