Skip to main content

Security Testing

Ensuring the application is secure by identifying vulnerabilities.

Also Known As

  • Automated Security Testing (in DevOps)
  • Build Quality In (in Lean Software Development)
  • Penetration Testing
  • Red Teaming
  • Security Assessment
  • Security Hardening
  • Vulnerability Testing

Related

Addresses / Mitigates

  • Security Risk: Identifies and addresses vulnerabilities in the software.
  • Operational Risk: Ensures the software can withstand security threats and attacks.
  • Legal Risk: Helps ensure compliance with security standards and regulations.
  • Agency Risk: Make sure that agents don't exercise unwarranted control over resources.

Attendant Risks

  • Schedule Risk: Security testing can be time-consuming, impacting schedules.
  • Complexity Risk: Requires specialized skills and tools, adding complexity.
  • Agency Risk: Likely requires security experts with specialist skills.
  • Emergent Behaviour: Helps identify unintended AI behaviors before deployment by stress-testing AI in real-world scenarios.
  • Agency Risk: Red teams probe AI for loopholes where reward hacking or proxy goals emerge, ensuring AI doesn't optimise in harmful ways.

Used By

  • DevOps: Security as Code and Automated Security Testing integrate security practices into the DevOps pipeline.
  • Lean Software Development: Lean ensures that security is built into the product from the beginning.

Description​

"Security testing is a process intended to reveal flaws in the security mechanisms of an information system that protect data and maintain functionality as intended." - Security testing, Wikipedia

Security Testing involves assessing the security of software applications to identify vulnerabilities and ensure they are protected against threats and attacks. This practice is essential for maintaining the integrity, confidentiality, and availability of software systems.

Variations​

Security Test TypeDescriptionReference
Penetration TestingSimulating attacks to find exploitable vulnerabilities in systems.Penetration Testing, Wikipedia
Red TeamingSimulating adversarial attacks to test defences, especially for AI behavioural risks.Red Team, Wikipedia
Vulnerability ScanningAutomated tools to identify known security weaknesses.Vulnerability Scanner, Wikipedia

Used By​

DevOps

DevOps

A set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and provide continuous delivery with high software quality.

Why: Security as Code and Automated Security Testing integrate security practices into the DevOps pipeline.

Uses:
  • Automated Security Testing
Lean Software Development

Lean Software Development

An Agile software development methodology that emphasizes eliminating waste, building quality in, creating knowledge, deferring commitment, delivering fast, respecting people, and optimizing the whole.

Why: Lean ensures that security is built into the product from the beginning.

Uses:
  • Build Quality In