This document discusses automated security testing. It begins with an agenda that includes what security testing is, why testers need to worry about it, why automate it, how to automate it, a demo, and resources. Security testing reveals flaws in security mechanisms and is part of software testing. Automated security testing can detect vulnerabilities early, reduce costs by lessening the need for security professionals, and use existing automated functional tests with attack proxies and scans. The document demonstrates how attack proxies work and provides resources for security testing tools.

1. AUTOMATED SECURITY TESTING

2. AGENDA
• What is Security Testing ?
• Why we Testers need to worry about it ?
• Why Automated Security Testing?
• How can we Automate this?
• Demo
• Resources

3. WHAT IS SECURITY TESTING
• Part of Software Testing
• Process intended to reveal flaws in the security mechanism.

4. I AM NOT A SECURITY TESTER !
• Why do we, Testers need to worry about security testing ? Isn’t
there a Security Team to handle this ?
• Tester = { Functional testing + Non Functional
(Performance, Security..)}

5. WHY AUTOMATED SECURITY TESTING?

6. • Detect known vulnerabilities early in the cycle
• Reduce Costs – Amount of time you need to hire Security
professional
• 10 min to get you started with your first Attack proxy and scan
• Can use your existing automated functional tests to generate
HTTP traffic, no need to write special security tests.

7. WHERE ARE WE ? AS ON 2014
United States
Japan
Spain
United Kingdom
Germany
China
Ukraine
Switzerland
Mexico
Canada

8. HOW DID WE DO? “ATTACK PROXIES”
• Sit between Target and Tester
- Search for http traffic patterns
- Manipulate headers
- Scan for vulnerabilities
- Fuzzing

9. ALWAYS REMEMBER
• Never run any Security Tests on sites that you
aren’t authorised to do so.

10. IN ACTION…

11. RESOURCES – SO MANY OPTIONS TO
EXPLORE!
• https://www.owasp.org/index.php/Appendix_A:_Testing_Tools

12. BDD IN SECURITY TESTING. IS IT POSSIBLE?

13. ON GITHUB
• https://github.com/impeccable-tester/SecurityTesting

14. I AM NOW A SECURITY TESTER 