type of security testing in web based application

Question

looking for Type of Security testing are dynamic and static analysis part of security testing? as QA tester do we need to know programming or coding language knowledge to perform security testing? at what phase of STLC or SDLC we can perform security testing?

Answer 1

For the best results, automated testing should be performed as code is being written. Programmers should continuously test using static and dynamic code analyzer plug-ins in their IDE. If the developers are presented with a ream of findings just before deployment, remediation will be problematic. The sheer volume of errors will be daunting; the number of false positives and insignificant findings will obscure the true positives. Moreover, the code will not be fresh in the minds of the development team. Many developers will have moved on; those that remain on the project may not be familiar with code written by their departed colleagues.

I recommend Chess and West's Secure Programming with Static Analysis. See also the discussion at Building a web application security focused team and Effectiveness of Interactive Application Security Testing The latter makes the argument for how interactive analysis demonstrates to the developer that the weakness is a real threat; showing how the code is exploitable makes it hard to shrug off the finding as just another false positive.

Static analysis testing of software source code is necessary but not sufficient. Of the nearly 1,000 entries in MITRE Common Weakness Enumeration, 40 percent can be introduced in the architecture and design phase of the development life cycle. See CWE-701: Weaknesses Introduced During Design at https://cwe.mitre.org/data/lists/701.html

By their very nature, architectural and design flaws are difficult to find via static analysis. Furthermore, fixes to architectural and design errors can be complex, can inject additional defects, and can alert adversaries to the existence of these weaknesses. Moreover design flaws can obscure coding bugs that static analysis might otherwise detect, as demonstrated by the Heartbleed vulnerability.

The more you know about programing and the language and frameworks used, the more effective you will be in helping the developers prevent errors. The more you know about programing and the language and frameworks used, the more effective you will be in helping the developers prevent errors.