Security testing

A use case in which some actors with malicious intent are causing harm to the system or to other actors.

The exit criteria that a component or system must satisfy in order to be accepted by a user, customer, or other authorized entity.

The process of obtaining user account information based on trial and error with the intention of using that information in a security attack.

The capability of the software product to provide the right or agreed results or effects with the needed degree of precision.

The behavior produced/observed when a component or system is tested.

A tool that carries out static analysis.

Software that is used to detect and inhibit malware.

A type of interface in which the components or systems involved exchange information in a defined formal structure.

The degree to which users can recognize whether a component or system is appropriate for their needs.

A path or means by which an attacker can gain access to a system for malicious purposes.

A person or process that attempts to access data, functions or other restricted areas of the system without authorization, potentially with malicious intent.

An independent evaluation of software products or processes to ascertain compliance to standards, guidelines, specifications, and/or procedures based on …

A procedure determining whether a person or a process is, in fact, who or what it is declared to be.

Permission given to a user or process to access resources.

The degree to which a component or system is operational and accessible when required for use. Often expressed as a percentage.

A network of compromised computers, called bots or robots, which is controlled by a third party and used to transmit malware or spam, or to launch attacks.

The percentage of branches that have been exercised by a test suite. 100% branch coverage implies both 100% decision coverage and 100% statement coverage.

A flaw in a component or system that can cause the component or system to fail to perform its required function, e.g., an incorrect statement or data …

A document reporting on any flaw in a component or system that can cause the component or system to fail to perform its required function.

An analysis technique aimed at identifying the root causes of defects. By directing corrective measures at root causes, it is hoped that the likelihood of …

(1) A structured approach to transitioning individuals and organizations from a current state to a desired future state. (2) Controlled way to effect a change, …

Testing based on an analysis of the internal structure of the component or system.

A type of security attack performed by inserting malicious code at an interface into an application to exploit poor handling of untrusted data.

A standard that describes the characteristics of a design or a design description of data or program components.

A software product that is developed for the general market, i.e. for a large number of customers, and that is delivered to many customers in identical format.

A software tool that translates programs expressed in a high-order language into their machine language equivalents.

The set of generic and specific conditions, agreed upon with the stakeholders for permitting a process to be officially completed. The purpose of exit criteria …

The degree to which a component or system has a design and/or internal structure that is difficult to understand, maintain and verify.

The capability of the software product to adhere to standards, conventions or regulations in laws and similar prescriptions.

Testing performed to expose defects in the interfaces and interactions between integrated components.

The testing of individual software components.

The practice of determining how a security attack has succeeded and assessing the damage caused.

A discipline applying technical and administrative direction and surveillance to identify and document the functional and physical characteristics of a …

Testing that runs test cases that failed the last time they were run, in order to verify the success of corrective actions.

A sequence of events (paths) in the execution through a component or system.

An abstract representation of all possible sequences of events (paths) in the execution through a component or system.

A sequence of consecutive edges in a directed graph.

The degree, expressed as a percentage, to which a specified coverage item has been exercised by a test suite.

A vulnerability that allows attackers to inject malicious code into an otherwise benign website.

The maximum number of linear, independent paths through a program. Cyclomatic complexity may be computed as L = N + 2P, where L = the number of edges/links in …

A representation of dynamic measurements of operational performance for some organization or activity, using metrics represented via metaphors such as visual …

The sequence of possible changes to the state of data objects.

Data transformation that makes it difficult for a human to recognize the original data.

The protection of personally identifiable information or otherwise sensitive information from undesired disclosure.

A scripting technique that stores test input and expected results in a table or spreadsheet, so that a single control script can execute all of the tests in the …

The process of finding, analyzing and removing the causes of failures in software.

A program point at which the control flow has two or more alternative routes. A node with two or more links to separate branches.

A physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, commonly the Internet.

A security attack that is intended to overload the system with requests such that legitimate requests cannot be serviced.

Any event occurring that requires investigation.

A document reporting on any event that occurred, e.g., during the testing, which requires investigation.

A software component or test tool that replaces a component that takes care of the control and/or the calling of a component or system.

The process of evaluating behavior, e.g., memory performance, CPU usage, of a system or component during execution.

Testing that involves the execution of the software of a component or system.

The capability of producing an intended result.

(1) The capability of the software product to provide appropriate performance, relative to the amount of resources used, under stated conditions. (2) The …

The process of encoding information so that only authorized parties can retrieve the original information, usually by means of a specific decryption key or …

A portion of an input or output domain for which the behavior of a component or system is assumed to be the same, based on the specification.

A human action that produces an incorrect result.

A security tester using hacker techniques.

A source code statement that, when translated into object code, can be executed in a procedural manner.

The behavior predicted by the specification, or another source, of the component or system under specified conditions.

Deviation of the component or system from its expected delivery, service or result.

A component or set of components that controls incoming and outgoing network traffic based on predetermined security rules.

The exploration of a target area aiming to gain information that can be useful for an attack.

The degree to which a component or system provides functions that meet stated and implied needs when used under specified conditions.

Testing based on an analysis of the specification of the functionality of a component or system.

A software testing technique used to discover security vulnerabilities by inputting massive amounts of random data, called fuzz, to the component or system.

A type of interface that allows users to interact with a component or system through graphical icons and visual indicators.

A person or organization who is actively involved in security attacks, usually with malicious intent.

Transformation of a variable length string of characters into a usually shorter fixed-length value or key. Hashed values, or hashes, are commonly used in table …

A generally recognized rule of thumb that helps to achieve a goal.

The damage that will be caused if the risk becomes an actual outcome or event.

A measure that can be used to estimate or predict another measure.

Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and …

Attributes of software products that bear on its ability to prevent unauthorized access, whether accidental or deliberate, to programs and data.

A variable (whether stored within a component or outside) that is read by a component.

A security threat originating from within the organization, often by an authorized system user.

A type of peer review that relies on visual examination of documents to detect defects, e.g., violations of development standards and non-conformance to higher …

Testing performed to expose defects in the interfaces and in the interactions between integrated components or systems.

The degree to which a component or system allows only authorized access and modification to a component, a system or data.

A system which monitors activities on the 7 layers of the OSI model from network to application level, to detect violations of the security policy.

A metric that supports the judgment of process performance.

The activities performed at each stage in software development, and how they relate to one another logically and chronologically.

The probability that a risk will become an actual outcome or event.

Modification of a software product after delivery to correct defects, to improve performance or other attributes, or to adapt the product to a modified …

Software that is intended to harm a system or its components.

Static analysis aiming to detect and remove malicious code received at an interface.

The interception, mimicking and/or altering and subsequent relaying of communications (e.g., credit card transactions) by a third party such that a user …

The number or category assigned to an attribute of an entity by making a measurement.

A measurement scale and the method used for measurement.

Testing based on or involving models.

Multiple heterogeneous, distributed systems that are embedded in networks at multiple levels and in multiple interconnected domains, addressing large-scale …

A sub-network with a defined level of trust. For example, the Internet or a public zone would be considered to be untrusted.

A software tool that is available to all potential users in source code form, usually via the internet. Its users are permitted, usually under license, to …

The intended environment for a component or system to be used in production.

A high-level document describing the principles, approach and major objectives of the organization regarding testing.

A high-level description of the test levels to be performed and the testing within those levels for an organization or programme (one or more projects).

The consequence/outcome of the execution of a test.

A variable (whether stored within a component or outside) that is written by a component.

A security attack recovering secret passwords stored in a computer system or transmitted over a network.

The percentage of paths that have been exercised by a test suite.

A white-box test design technique in which test cases are designed to execute paths.

A testing technique aiming to exploit security vulnerabilities (known or unknown) to gain unauthorized access.

The degree to which a system or component accomplishes its designated functions within given constraints regarding processing time and throughput rate.

A security attack intended to redirect a web site's traffic to a fraudulent web site without the user's knowledge or consent.

An attempt to acquire personal or sensitive information by masquerading as a trustworthy entity in an electronic communication.

Environmental and state conditions that must be fulfilled after the execution of a test or test procedure.

The level of (business) importance assigned to an item, e.g., defect.

A framework in which processes of the same nature are classified into an overall model.

Part of quality management focused on providing confidence that quality requirements will be fulfilled.

Testing of a previously tested program following modification to ensure that defects have not been introduced or uncovered in unchanged areas of the software, …

A condition or capability needed by a user to solve a problem or achieve an objective that must be met or possessed by a system or system component to satisfy …

An approach to testing in which test cases are designed based on test objectives and test conditions derived from requirements, e.g., tests that exercise …

An evaluation of a product or project status to ascertain discrepancies from planned results and to recommend improvements. Examples include management review, …

A factor that could result in future negative consequences.

The process of assessing identified project or product risks to determine their level of risk, typically by estimating their impact and probability of …

The process of identifying and subsequently analyzing the identified project or product risk to determine its level of risk, typically by assigning likelihood …

The importance of a risk as defined by its characteristics impact and likelihood. The level of risk can be used to determine the intensity of testing to be …

The process of identifying risks using techniques such as brainstorming, checklists and failure history.

Systematic application of procedures and practices to the tasks of identifying, analyzing, prioritizing, and controlling risk.

The process through which decisions are reached and protective measures are implemented for reducing risks to, or maintaining risks within, specified levels.

A cryptographic technique that adds random data (salt) to the user data prior to hashing.

The degree to which a component or system can be adjusted for changing capacity.

A person who executes security attacks that have been created by other hackers rather than creating one's own attacks.

An attempt to gain unauthorized access to a component or system, resources, information, or an attempt to compromise system integrity.

An audit evaluating an organization's security processes and infrastructure.

A high-level document describing the principles, approach and major objectives of the organization regarding security.

A set of steps required to implement the security policy and the steps to be taken in response to a security incident.

A quality risk related to security.

Testing to determine the security of the software product.

A weakness in the system that could allow for a successful security attack.

The degree of impact that a defect has on the development or operation of a component or system.

An attempt to trick someone into revealing information (e.g., a password) that can be used to attack systems or networks.

The period of time that begins when a software product is conceived and ends when the software is no longer available for use. The software lifecycle typically …

An entity in a programming language, which is typically the smallest indivisible unit of execution.

A type of code injection in the structured query language (SQL).

Formal, possibly mandatory, set of requirements developed and used to prescribe consistent approaches to the way of working or to provide guidelines (e.g., …

The percentage of executable statements that have been exercised by a test suite.

Analysis of software development artifacts, e.g., requirements or code, carried out without execution of these software development artifacts. Static analysis …

Testing of a software development artifact, e.g., requirements, design or code, without execution of these artifacts, e.g., reviews or static analysis.

A step-by-step presentation by the author of a document in order to gather information and to establish a common understanding of its content.

A skeletal or special-purpose implementation of a software component, used to develop or test a component that calls or is otherwise dependent on it. It …

The step-by-step process of reducing the security vulnerabilities of a system by applying a security policy and different layers of protection.

Testing the integration of systems and packages; testing interfaces to external organizations (e.g., Electronic Data Interchange, Internet).

Testing an integrated system to verify that it meets specified requirements.

A peer group discussion activity that focuses on achieving consensus on the technical approach to be taken.

A set of one or more test cases.

The process of analyzing the test basis and defining test objectives.

The implementation of the test strategy for a specific project. It typically includes the decisions made that follow based on the (test) project's goal and the …

(1) A person who provides guidance and strategic direction for a test organization and for its relationship with other disciplines. (2) A person who defines the …

All documents from which the requirements of a component or system can be inferred. The documentation on which the test cases are based. If a document can be …

An environment containing hardware, instrumentation, simulators, software tools, and other support elements needed to conduct a test.

A set of input values, execution preconditions, expected results and execution postconditions, developed for a particular objective or test condition, such as …

During the test closure phase of a test process data is collected from completed activities to consolidate experience, testware, facts and numbers. The test …

An item or event of a component or system that could be verified by one or more test cases, e.g., a function, transaction, feature, quality attribute, or …

Data that exists (for example, in a database) before a test is executed, and that affects or is affected by the component or system under test.

The process of running a test on the component or system under test, producing actual result(s).

A test tool that executes tests against a designated test item and evaluates the outcomes against expected results and postconditions.

The process of developing and prioritizing test procedures, creating test data and, optionally, preparing test harnesses and writing automated test scripts.

A tool that provides support to the test management and control part of a test process. It often has several capabilities, such as testware management, …

The person responsible for project management of testing activities and resources, and evaluation of a test object. The individual who directs, controls, …

The component or system to be tested.

A reason or purpose for designing and executing a test.

A document describing the scope, approach, resources and schedule of intended test activities. It identifies amongst others test items, the features to be …

The activity of establishing or updating a test plan.

The fundamental test process comprises test planning and control, test analysis and design, test implementation and execution, evaluating exit criteria and …

Collecting and analyzing data from testing activities and subsequently consolidating the data in a report to inform stakeholders.

Commonly used to refer to a test procedure specification, especially an automated one.

A document that consists of a test design specification, test case specification and/or test procedure specification.

A software product that supports one or more test activities, such as planning and control, specification, building initial files and data, test execution and …

A group of test activities aimed at testing a component or system focused on a specific test objective, i.e. functional test, usability test, regression test …

The capability of the software product to enable modified software to be tested.

A skilled professional who is involved in the testing of a component or system.

The process consisting of all lifecycle activities, both static and dynamic, concerned with planning, preparation and evaluation of software products and …

The capability of the software to be understood, learned, used and attractive to the user when used under specified conditions.

All components of a system that provide information and controls for the user to accomplish specific tasks with the system.

Confirmation by examination and through provision of objective evidence that the requirements for a specific intended use or application have been fulfilled.

Confirmation by examination and through provision of objective evidence that specified requirements have been fulfilled.

A static analyzer that is used to detect particular security vulnerabilities in the code.