Where can I find software security test plan templates?

Where can I find software security test plan templates?

Are there templates available for security test plans? Or how do design a good test plan for security?

    Requires Free Membership to View

    Login

    When you register, you'll receive targeted emails designed to keep you informed of the most relevant information on Agile development, application security, testing & QA, software requirements, and more.

    Hannah Smalltree, Editorial Director

    By submitting your registration information to SearchSoftwareQuality.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSoftwareQuality.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

There is no one best approach for security test plans. It all depends on your specific application and your specific business needs. Do you need to perform simple penetration testing? Are you looking to perform a more in-depth security assessment of the application and its supporting systems? Maybe source code analysis is all you need? Perhaps you need some basic use cases to check for common security flaws?

The most important question you have to answer is: What are we trying to accomplish here? Do you need an all out assessment so you can sleep at night knowing your customers have gotten the most secure application from your team? Or, are you trying to meet some basic minimum security standards from a customer, business partner, or regulatory body such as those mandated by the PCI Standards Council?

The main areas to test center around user access, data input, and system configuration. Look at all of these areas from the perspectives of both untrusted outsiders (without authentication) and trusted insiders (with authentication). A combination of good vulnerability scanners, source code analyzers, and manual analysis across these main areas will serve to uncover the security flaws that matter in your environment - especially if you already have a documented set of requirements and standards upon which the application was built.

This was first published in July 2010

Back to top