Summary

In this chapter, we have suggested the setting up of a security-testing knowledge kit to include the testing guides and related security tools. The OWASPSecurity Knowledge Framework (SKF) provides an in-house security-testing knowledge portal with an OWASP ASVS checklist, security knowledge, and a code example by default. The security team can use the OWASP SKF to further customize the security-testing knowledge portal. 

To develop a security-testing plan, we suggested referring to the industry references, such as an OWASP testing guide, a PCI penetration testing guide, a NIST 800-115, and a Mobile Security Testing Guide (MSTG). One typical security-testing plan should include the testing objective, baseline, testing environment, testing strategy, identified high-risk modules, and also the recommended security-testing tools.

 

We also discussed some OWASP projects that can help the web and mobile applications security testing. In addition to this, we discussed the fact that how the...