Practical Security Automation and Testing

Security testing communication

Being able to articulate the security testing plan, execution, and results in a way that non-security team members can understand is critical to the project. This will help stakeholders understand what security testing is performed and how. Too many technical and security domain-specific terms may result in the security testing being too difficult to understand.

For example, the business objective of security is to protect the application against injection attacks. However, in the domain of security testing, 'injection attacks' may be specifically described as XML External Entity (XXE) attacks, Cross-Site Scripting (XSS) attacks, command injection, and SQL injection. Use of this terminology may cause communication ...