Path to becoming a security tester for a QA Engineer?

Question

I was looking for some guidelines/documentation on how to start security testing my app and progress on as a security tester. It seems interesting to me to be able to break an application using trial and error methods at various points like login, modifying the URL and some amount of sql injection. Career wise what are the prospects?

My background: Have a computer science degree, started off with manual testing , Doing Automated UI testing (Webdriver, Abbot).

Answer 1

It is hard to find very knowledgeable security experts in QA, mostly because it is extremely complex, and requires constant learning and keeping up on trends. There are a number of things that you would absolutely need to know in order to be considered a "security expert". The biggest challenge is that it's not OK to know some of these things, or to have some familiarity with them, you really need to have an intimate familiarity and deep understanding of all of them, which is why a true security expert is so rare. This isn't meant to scare you off, just set realistic expectations of what I would expect from a "security engineer". With that being said, I think ALL QA Engineers should be familiar with security issues and be able to at least at a high level find and point out potential issues.

1. Knowledge of and experience with various tools for security testing.
2. Networking, protocols and authentication mechanisms.
3. Server configurations, load balancers, proxies, firewalls, and the entire internet stack.
4. JavaScript, browsers, browser settings, known browser vulnerabilities, etc.
5. Interactions between front-end, middle tier, databases and all backends, etc.
6. Programming language differences and vulnerabilities.
7. OS differences, configurations and vulnerabilities.
8. All major known attacks (and probably most of the minor ones as well)
9. Ability to assess attack surface and vulnerability of systems
10. Ability to execute attacks of all kinds
11. Development and architecture techniques to avoid vulnerabilities.

This is by no means an exhaustive list, and every line item above represents easily hundreds of hours of research and experience. If you are truly interested then my advice is this - start slow, focus on one thing at a time and become an expert in that one thing and then move on. Also a caution - do not call yourself a "security engineer" or expert until you can check off every thing in that list. If you bill yourself a security engineer and do not have the skills required, you can be liable if there are security flaws due to your lack of knowledge. Being a security engineer can be very lucrative, but it also requires a ton of knowledge and expertise and can leave you and the companies you work for open to liability if you do not know what you claim to know.