ISTQB CT-STA

وصف

An ISTQB® Certified Security Test Analyst can:

• Explain organizational assets, their value, and the security risks associated with them.
• Use an understanding of attacker motivations and methods to support security testing.
• Connect risk management, internal control systems, and security regulations with security test activities.
• Define security test objectives and apply appropriate test strategies throughout the software development lifecycle.
• Specify security testing work packages and plan the resources, activities, and schedules needed to execute them.
• Interpret security test results, communicate findings, and prioritize actions to address identified vulnerabilities.

Chapter 1: Asset Security and Risk Assessment

• Asset Security
  • Explain what an asset is, including tangible and intangible assets.
  • Explain the value of an asset, considering business continuity, recovery costs, reputational damage, and other consequences of its loss.
  • Apply risk identification techniques to determine potential security risks to a protected asset.
• Security Risk Assessment of Assets
  • Interpret risk assessments for assets, considering risk likelihood, risk impact, and the organizational context.
  • Understand how business impact analysis supports security risk assessment.

Chapter 2: The Attacker Mindset and Methods of Operation

• Attacker Motivations and Methods
  • Give examples of how knowledge of an attacker’s motivations can enhance the work of a Security Test Analyst.
  • Apply methods an attacker might use to discover information that can support security testing.
  • Use passive and active reconnaissance approaches, including publicly available information and direct exploration of systems.
• Insiders and External Attackers
  • Give examples of specific risks posed by insiders, including unintentional, malicious, collusive, and third-party threats.
  • Distinguish between external attackers and insiders in the context of security testing.

Chapter 3: Risk Management, Internal Control Systems, and Regulations

• Risk Management
  • Explain risk management methodologies and the activities involved in identifying, assessing, treating, communicating, and monitoring risks.
  • Analyze identified security risks and their business context to support appropriate risk management decisions.
  • Consider risk acceptance, mitigation, avoidance, and transfer when recommending risk treatments.
• Internal Control Systems
  • Apply the relationship between security policies and internal control systems.
  • Define security checks that verify whether approved policies are fulfilled.
  • Apply security control activities, including evaluating results and refining checks when necessary.
• Test Activities Derived from Regulations
  • Use applicable security regulations to derive test activities.
  • Adapt prescribed regulatory control activities to the system under test.
  • Define test cases and expected results when regulatory requirements do not specify a test procedure.

Chapter 4: Security Test Objectives, Strategies, and Activities

• Security Test Objectives and Strategies
  • Summarize security test objectives relating to compliance, risk, assurance, and improvement.
  • Explain how a security test strategy guides scope, approaches, coverage, techniques, tools, and resources.
  • Apply appropriate security test strategies within a given project scenario.
• Security Test Activities Throughout the Software Development Lifecycle
  • Implement suitable security test activities within agile and waterfall-based development lifecycles.
  • Integrate security requirements, threat modeling, and security design reviews into early development activities.
  • Include incremental security verification, pre-release validation, and operational security assessment at appropriate stages.

Chapter 5: Security Testing Work Packages and Test Planning

• Defining Security Test Work Packages
  • Summarize the characteristics of software testing work packages, including objectives, scope, tasks, deliverables, resources, and acceptance criteria.
  • Apply security-specific considerations when defining work packages, including uncertain effort estimates, specialist competencies, and sensitive findings.
  • Specify suitable security test environments, including isolation, representative configurations, and recovery capabilities.
• Planning Security Testing
  • Explain the different aspects involved in security test planning, including scope, responsibilities, schedules, environments, tools, and approvals.
  • Implement a test plan for security testing work packages by acquiring resources, agreeing on deliverables, and scheduling activities.
  • Apply test monitoring and test control, and review testware for completeness and correctness.

Chapter 6: Interpreting Test Results and Defining Actions

• Communicating Security Test Results
  • Explain the key aspects of security test report communication.
  • Adapt the presentation of findings to the needs of technical teams, management, and other stakeholders.
  • Understand the need for immediate communication of critical vulnerabilities and appropriate handling of sensitive reports.
• Managing Report Follow-Ups
  • Explain how to manage security test report follow-ups to support timely vulnerability mitigation.
  • Consider vulnerability severity, business criticality, security requirements, and opportunities to change code or the environment when recommending actions.
• Prioritizing Necessary Actions
  • Analyze a security test report to prioritize necessary actions in the relevant business and operational context.
  • Consider staged mitigation, related vulnerabilities, and confirmation testing when defining follow-up activities.
  • Recommend improvements that address recurring causes as well as individual vulnerabilities.