High-profile data breaches in the last few years have put data security at the forefront of political, tech, and business news. A whopping 1.4 billion records were exposed in 686 breaches in Q1 of 2018 alone. Though data breaches have been trending down, security should remain a critical priority for organizations and their development teams.

However, despite a rising need for stronger security, many organizations continue to drag their feet, emphasizing shorter release cycles over secure development and mitigation processes. The prevailing attitude is develop first, test later. This attitude opens up applications to vulnerabilities and makes them more difficult to address on the back end.

But by shifting the culture and implementing better software security testing processes, project managers and stakeholders can turn security into a strength—not a weakness—for their organization.

What is security testing?

Security testing is a process that aims to identify and test vulnerabilities or weaknesses in a software application. Much like functional testing, QA teams identify a security risk, define what the application or feature behavior should be, and then perform the function to verify that it operates correctly.

Security testing typically includes:

• Authentication
• Authorization
• Confidentiality
• Availability
• Integrity
• Resilience
• Non-repudiation

The key difference between functional and security testing is that security testing often requires more work. Functional testing is fairly direct: You identify the risk and test that it works. With security testing, testers have to check against multiple types of attacks to verify the application is secure. They must think like a hacker, not the end user.

For example, here are just a few types of attacks your application might be vulnerable to:

• SQL injection
• Unauthorized data access
• Denial of service (DoS)
• URL manipulation
• Identity spoofing
• Cross-site scripting (XSS)

Different security testing processes can address each of these potential threats or flaws to protect your application against attack.

Why is security testing important?

So, what’s the big deal? If there’s data, there’s a need to safeguard it.

From elections and energy grids to retail giants and banking institutions, hackers target servers and applications across industries to steal, manipulate, and leverage data against users and organizations. Without a strong security testing program, your software applications (and those who use them) are at risk.  

If that isn’t enough to convince you, consider the bottom line. The average cost of a data breach for an organization was $3.6 million in 2017.

And security breaches are costly in more ways than one, including:

• Regulatory fines
• Legal fees
• Technical repair costs
• Lost profits
• Reputation damage (and mitigation)
• Website downtime   

For smaller organizations, this kind of breach won’t cost just a slap on the wrist and a few weeks of embarrassment. It could cost the business itself.

How to improve your security testing program

Though security testing may require longer releases, it will save you time and money in the long run. So how can you level up your web security testing? No matter where your team or organization is starting from, there are several ways you can improve your testing program.

Conduct threat modeling during design stage

One of the main issues plaguing organizations today is a reluctance to invest in security testing before and during active development. When teams develop first and test later, it becomes much more difficult to fix bugs and reinforce weak points in an application.  

Instead, aim to build security right into the application’s design—and you can achieve this through threat modeling.

Threat modeling is a process used to identify the different ways a hacker could damage an application before the application is developed. By asking where and how an attacker could breach an application before it’s even built, your team can adapt the design and develop the program to prevent it. This process saves time and money by streamlining the design and security testing stages.

For best results, create your threat model graphically to visualize how data will flow, where it will be stored, and how users will interact with it.

Integrating security testing into the development process results in a stronger and more secure web application.

Develop deep understanding of your application

One of the best ways to improve your security testing processes is to develop a deep knowledge of your application. Security testing will differ greatly between applications depending on the types of data collected and stored and the architecture of the app.

The better you understand your application, the easier it will be to identify potential risks. This is important not only during the design phase of the development lifecycle (i.e., threat modeling) but throughout the development process as the project evolves.

Create a culture of security

Your team and organization’s attitude toward security testing has a significant impact on the quality of your security program. In fact, a study conducted by North Carolina State University found that “the two things that were most strongly associated with using security tools were peer influence and corporate culture.”

In other words, if you want a robust security program, you need buy-in from stakeholders at every level of the organization.

One way to promote this culture is to designate a “security champion” on your team. The security champion is the technical person whose primary responsibility is software security.

As the PCI Security Standards Council explains, “This person should keep up to date with all threats that could affect the software written by the organization and should ensure that secure coding standards are maintained and being used.”

Get them involved in security activities like threat modeling, design, and review. Give them space to provide feedback on the team’s ongoing security performance to identify areas for improvement and garner investment and enthusiasm from developers.  

Use a coding library

Another strategy to improve and standardize your security testing program is to use a coding library. These coding libraries provide templates for how to implement codes for common tasks securely.

By adhering to pre-tested, secure code models, you can ensure your developers are coding to a known standard. While it’s not a silver bullet or a replacement for security testing, a coding library streamlines and improves communication between developers and security testers and increases development and security testing efficiency.

Document and follow repeatable processes

Finally, if you want a stronger security testing program, you’ll need to rely on project management’s mainstay: documentation.

Treat security testing as you would any other process in your project. Document the steps of the testing process and continually review and update the approach to create a standard strategy for your team.

Lucidchart makes it easy to document and visualize your security testing process in one place. Integrations and sharing options allow you to share the process with your team so everyone understands what steps to take and when.

Choose from one of the flowchart templates or build your own process graphics using the library of shapes. By documenting a visual process, you will be able to identify security gaps more easily, address communication breakdowns, and keep your testing program on track.