登录查看更多内容

How can you use exploratory testing to enhance software security?

由人工智能和领英社区提供技术支持

Exploratory testing is a technique that involves testing software without predefined scripts, plans, or cases. Instead, testers use their creativity, intuition, and experience to explore the software's functionality, behavior, and security. Exploratory testing can help you enhance software security by uncovering hidden vulnerabilities, exposing unexpected scenarios, and simulating real-world attacks. In this article, you will learn how to use exploratory testing to enhance software security in four steps: define your objectives, scope, and risks; design and execute your tests; document and report your findings; and learn and improve your process.

此文章中的业界达人

由社区从 2 条内容中精选。了解更多

Carlos Bruzzone

?? Bienestar Humanizo y Transformo tu Liderazgo ??Neurociencia del Liderazgo |??Advisor World Happiness Foundation |…

1 Define your objectives, scope, and risks

Before you start exploratory testing, you need to have a clear idea of what you want to achieve, what you want to test, and what you want to avoid. Your objectives should be aligned with your software security goals, such as preventing data breaches, ensuring compliance, or protecting user privacy. Your scope should define the boundaries of your testing, such as the features, functions, or modules you want to focus on. Your risks should identify the potential threats, vulnerabilities, or weaknesses that could compromise your software security, such as injection attacks, cross-site scripting, or broken authentication.

添加您的观点

Carlos Bruzzone

?? Bienestar Humanizo y Transformo tu Liderazgo ??Neurociencia del Liderazgo |??Advisor World Happiness Foundation | ??Transformación Cultural y Gestión del Talento | ??People Analytics | ??Liderazgo 360 | ?? PNL
举报内容
El objetivo principal: Encontrar errores en el software, especialmente aquellos que podrían tener un impacto en la seguridad del mismo. Las pruebas pueden ayudar a los probadores a aprender más sobre el software que están probando, ayudarlos a identificar mejor los riesgos potenciales. Al encontrar y corregir errores, pueden ayudar a mejorar la calidad general del software. Alcance: El alcance de las pruebas puede incluir toda la funcionalidad del software o solo una parte específica. Pueden realizarse en diferentes plataformas, ordenadores, dispositivos móviles o navegadores web. Datos: Pueden realizarse con diferentes conjuntos de datos, datos de prueba o datos reales. Riesgos: cubrir todas las áreas del software con algún error.

已翻译

赞

2 Design and execute your tests

Once you have defined your objectives, scope, and risks, you can begin designing and executing your tests. Exploratory testing does not require a fixed sequence or procedure. Rather, you can use heuristics, charters, tools, and methods to generate and perform your tests. Heuristics are rules of thumb or shortcuts that help identify and prioritize areas of interest. Charters are brief statements that describe the purpose, scope, and duration of the testing session. Tools are software or hardware devices that assist in performing tests, such as security scanners or proxies. Methods are specific ways of conducting tests, such as exploratory testing sessions or attacks. For example, you can use the STRIDE model to classify security threats into six categories or a tool like ZAP to scan for common vulnerabilities. Additionally, you can use a security tour to systematically explore different aspects of software security.

添加您的观点

Alena Badzilouska

Level up QA process 》》》 Test Lead ● Advanced Test Manager ISTQB ● Automation ● Java & genAI in Testing
举报内容
When talking about exploratory testing, let's remember that in this case, test development and execution occur simultaneously and dynamically. And the basis for designing tests is the knowledge of the tester, research of the test task and the results of previous tests. SO, only experienced security testers can perform this trick :) And some may find it useful to do this in sessions with a clear testing charter.

已翻译

赞

3 Document and report your findings

As you perform your tests, you should document and report your findings in a clear, concise, and actionable way. Your documentation should capture the details of your tests, such as the steps, inputs, outputs, observations, and issues. Your report should summarize the results of your tests, such as the objectives, scope, risks, coverage, findings, and recommendations. You should use formats and tools that facilitate communication and collaboration with your stakeholders, such as notes, screenshots, videos, logs, or bug tracking systems. For example, you can use a tool like Jira to create, assign, and track bug tickets for your software security issues.

添加您的观点

4 Learn and improve your process

After you complete your tests, you should learn and improve your process by reflecting on your experience, feedback, and outcomes. You should evaluate the effectiveness and efficiency of your tests, such as the quality, quantity, and value of your findings. You should also identify the strengths and weaknesses of your process, such as the skills, techniques, tools, and methods you used. You should then use this information to plan and implement improvements for your future tests, such as learning new skills, adopting new techniques, or acquiring new tools. For example, you can use a tool like TestRail to manage, track, and review your exploratory testing activities and metrics.

添加您的观点

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Engineering Management

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you use exploratory testing to enhance software security?

1

2

3

4

5

1 Define your objectives, scope, and risks

2 Design and execute your tests

3 Document and report your findings

4 Learn and improve your process

5 Here’s what else to consider

Engineering Management

给文章评分

感谢您的反馈

更多Engineering Management相关文章

更多相关阅读内容

How can you use exploratory testing to enhance software security?

1

2

3

4

5

1 Define your objectives, scope, and risks

2 Design and execute your tests

3 Document and report your findings

4 Learn and improve your process

5 Here’s what else to consider

Engineering Management

给文章评分

感谢您的反馈

查看其他技能