Security Testing Fundamentals

Course Description

This course explains the fundamental theoretical framework and practical techniques for security testing. It teaches how to identify security vulnerabilities according to best practices.

Intended Audience

The course is relevant to security testers and testers, business analysts and developers who test and/or design web-based applications.

Course Content

This course covers the following areas:

• Overview of Security Testing
  The ever increasing vulnerability of our websites and system architecture raises the need for comprehensive security testing. An overview of these requirements and standards is provided in the scope of web-based applications, system architectures and physical work environment. The different types of security testing methods and techniques will be discussed.

• User Interface Attacks
  One of the most common - and easiest - methods to breach the security of web-based applications is through user interface attacks. Hackers or security intruders of websites use an error-guessing fault model by exploring the behaviour of inputs and outputs. The 10 common types of user interface attacks will be discussed as a fault model to guide security testing for web-based applications.

• Competitive Intelligence Scouting
  Security intruders of websites do not necessarily need to interact directly with the actual site in order to gather information for hacking preparations. The amount of information exposed in the Worldwide Web about companies, systems, past employees, press releases and third-party web searches, can result in possible security vulnerabilities. Guidelines on how to perform competitive intelligence scouting via the Worldwide Web will be discussed.

• Privilege Testing, Containment Testing and Password Cracking
  Denial of Services is a situation where a circumstance, - intentional or accidental -  prevents the system from functioning as intended and may lead to security vulnerabilities in the application. Privilege testing, containment measures testing, and password cracking are typical types of testing for Denial of Services.

• Google Hacking
  This section covers how to use the Google web interface to serve as a third-party search for site mapping, directory listings, obtaining web server software or version, and as a CGI scanner on web-based applications.

Course details

• Prerequisites
  It will be advantageous for candidates to have completed the Practical Software Testing course and have general knowledge of the internet and networks.

• Course presentation and duration
  An experienced software testing practitioner will present this course. The course duration is one day. The training runs from 08:00 to 17:00. This includes a lunch and two tea breaks daily.

• Training Style
  The course is conducted in a workshop environment. Candidates use practical tasks to consolidate theoretical concepts. Testing-related problems encountered in the workplace will be discussed in the course.

• Course materials, certification and assessment
  Comprehensive course notes are provided. Practical exercises, which are completed during the course, are handed in for evaluation. On successful completion of this course, the Test and Data Services’ Certificate in Security Testing Fundamentals is awarded. The candidate’s result will be displayed on the certificate.

• Location
  Training is conducted at one of the Test and Data Services training centres in Midrand, Durban, or Cape Town. Training can also be arranged at the client’s premises, depending on adequate facilities and candidate numbers.

Contact

	Gauteng	Cape Town	All Other Areas
Telephone	(011) 848-7600	(021) 447-1147	(011) 848-7600
Fax	(011) 848-7611	(021) 447-1148	(011) 848-7611
Physical Address	Tuscan Gardens Office Park 1740 14th Street Noordwyk	A308 Gate House Black River Office Park Fir Street Observatory
Postal Address	P O Box 14138 Lyttelton 0140	P O Box 12968 Mowbray 7705	P O Box 14138 Lyttelton 0140
Training Enquiries	training@testdata.co.za (011) 848-7600	training.ct@testdata.co.za (021) 447-1147	training@testdata.co.za (011) 848-7600
General Enquiries	info@testdata.co.za (011) 848-7600	info.ct@testdata.co.za (021) 447-1147	info@testdata.co.za (011) 848-7600
Test Focus Magazine	info@testfocus.co.za (011) 848-7600	info@testfocus.co.za (011) 848-7600	info@testfocus.co.za (011) 848-7600