Security

Questions

Is there a worthwhile distinction between HTTP and other protocols?
Checklists and loops come up a lot, but they don't sit right with my brain. Can they be merged in a satisfying way?
Can a security test be benchmarked in a useful way? Breadth or depth first testing? Coverage will be incomplete, how is it maximized?
What value does vulnerability classification provide to the testing process? By testing technique? Vector? Exposure? Impact?
What factors determine impact? Headlines? Fines? Crimes? Consumer perceptions?
What is the minimum time to make a valuable statement about an application? How are time and value related? Can a process relate time and meaning linearly? Is that valuable? A baseline from regulations? An upper limit of the best new research?
What does security testing look like in a DevOps environment?
What can security testing apply from other software testing types? Can this be transferred back to facilitate DevOps?

References

OWASP ASVS
OWASP MASVS and MSTG
Penetration Testing Execution Standard
MITRE ATT&CK
PortSwigger Annual Top 10
Conference presentations
PWNIES
Press
Academia
STRIDE)
Threat Modeling by Frank Swiderski and Window Snyder

Standards

ISO 27001
NIST SP 800-53 Rev 5
PCI DSS
SWIFT CSCF
CREST Examinations
Canada: ITSG-33. ITSP.30.031 v3 User Authentication Guidance for Information Technology Systems
EU: ENISA (European Union Agency for Cybersecurity)
CVSS
Exploit Prediction Scoring System (EPSS)

Vulnerability Categories

OWASP Top 10

Broken Access Control
Cryptographic Failures
Injection
Insecure Design
Security Misconfiguration
Vulnerable and Outdated Components
Identification and Authentication Failures
Software and Data Integrity Failures
Security Logging and Monitoring Failures
Server-Side Request Forgery (SSRF)

Benchmarks

What metrics can be used to evaluate the effectiveness of a process?

No safe is perfect, but there are known realistic lower bounds on the time required to breach or manipulate various models. So you might have a safe good for 30 minutes. What good is that? You now know that you need a burglar alarm with a < 29 minute response!

Matt Blaze https://twitter.com/mattblaze/status/1553888561736433675

Coverage of real world vulnerabilities: Would the process have discovered the vulnerability?
Coverage of known vulnerable application: Generate applications with random occurrences and variations of vulnerabilities. Measure the time taken and completeness of the process.