Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

Can anyone recommend any good security testing resources? Although I have a basic security skillset, I'd like to improve this. Some of the training I've seen online however seems kind of sketchy. Resources would have to be a reasonable price.

I know that there's no one answer for this, but still, hoping for some recommendations.

share|improve this question
1  
Not really an answer, but one big thing to keep in mind about security is that a lot of it isn't necessarily related to your app, but rather the environment your app runs in. One of the best things you can do to test security is to set up the app in a fresh environment. If the security measures aren't part of the scripted install/setup process, it's just begging to get breached when someone forgets a step like... locking down iptables or forgetting a database or file permission or something. –  corsiKa May 8 '11 at 6:52
add comment

9 Answers

up vote 8 down vote accepted

For web application security you might find it useful - https://www.owasp.org/index.php/Main_Page

share|improve this answer
    
Although the other answers were very good, and I already have some experience with OWASP, I have to say that OWASP is still the best resource out of what was presented. –  Lyndon Vrooman Jun 9 '11 at 23:24
add comment

How to Break Software Security

This book has a lot of good ideas you can try.

share|improve this answer
    
Very good book to pick up & have on your shelf. –  CKlein May 9 '11 at 12:55
add comment

Also consider doing threat models - IME, when testers are part of the threat model process, they generally find security issues nobody else does.

share|improve this answer
    
Hadn't come across threat models before - thanks, sounds useful! –  testerab May 8 '11 at 22:14
add comment

http://www.hackthissite.org/pages/index/index.php

Googles site for security testing: http://google-gruyere.appspot.com/ - really useful.

Try going through both sites with a copy of the book suggested by Alan - they really complement each other.

share|improve this answer
add comment

For web application security you could try with some tools like

share|improve this answer
1  
Is Grendel Scan still maintained? I see the last blog post for it was in 2008. –  Lyndon Vrooman May 11 '11 at 19:43
add comment

If security is important to the success of your application, I would suggest hiring professionals from firms such as HP, Cigital, SecurityCompass, etc and observing how they approach it. Books and websites are one thing, but you really need mentorship too...

share|improve this answer
add comment

Saw this site recommended recently as a good resource for those wanting to practice security testing:

http://hackademic1.teilar.gr/

share|improve this answer
    
Interesting. Starting to check it out. –  Lyndon Vrooman May 8 '11 at 20:59
add comment

How to Test Application Security – Web and Desktop Application Security Testing Techniques

http://www.softwaretestinghelp.com/how-to-test-application-security-web-and-desktop-application-security-testing-techniques/

share|improve this answer
    
Could you rather put all your answers in a single one and classify links in a way that will help readers select the right reading? –  dzieciou Nov 3 '12 at 17:18
add comment

http://www.javaworld.com/javaworld/javatips/jw-javatip96.html

Package java.security

http://docs.oracle.com/javase/1.4.2/docs/api/java/security/package-summary.html

• Message digest algorithms • Digital signature algorithms • Symmetric bulk encryption • Symmetric stream encryption • Asymmetric encryption • Password-based encryption (PBE) • Elliptic Curve Cryptography (ECC) • Key agreement algorithms • Key generators • Message Authentication Codes (MACs) • (Pseudo-)random number generator

http://www.oracle.com/technetwork/java/js-white-paper-149932.pdf

Low Level Security in Java

http://www.w3.org/Conferences/WWW4/Papers/197/40.html

Book: Java Security By Scott Oaks

Java Security

http://groups.csail.mit.edu/mac/users/jbank/javapaper/javapaper.html

share|improve this answer
    
Have you found those resources useful? Can you tell something more about them, besides citing? –  dzieciou Nov 3 '12 at 17:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.