Is security testing the sole responsibility of testers or part of a mixed team?

Question

Details: The well-known differences between API/GUI i.e. Functional Test are clearly defined. However, I ask myself the question: Does security testing belong in the focus of testers at all? Or shouldn't they rather be solved by a mixed team?

Aren't DevOPs engineers more responsible for this?

I myself always think in two ways, because on the one hand we testers are also responsible for it. But many times, when we set up different test procedures, the result is always the status that more DevOps tasks arise here, up to and including development tasks.

How do you see that?

Answer 1

All aspects of quality - functional and non-functional testing - should be solved by the whole team. Introducing a wall where developers develop and testers test introduces hand-offs, which increases communication needs and can slow down the overall process.

Everyone is responsible for security:

• DevOps is a "shift left" mindset, which moves operational considerations earlier in the product development life cycle. That implies that operational specialists are providing input during requirements engineering and design. These inputs include security.
• Developers should be looking to incorporate automated security analysis tools into their process. Static analysis can find defects in the code early and can be incorporated into builds. Software composition analysis tools can find risks and vulnerabilities in dependencies. Understanding secure coding techniques can reduce vulnerabilities injected or find them at code review time.
• Developers and operators can introduce dynamic analysis to run the software system and report potential vulnerabilities. Dynamic analysis tools can be run against development, test, or staging environments regularly.
• Testers, with a knowledge of common weaknesses and vulnerabilities can incorporate this knowledge into test cases.
• Operators can include monitoring to detect suspicious activities or patterns that may indicate attempts to find and exploit vulnerabilities and take appropriate action.

The key, in my opinion, is to stop thinking like "developer", "tester", or "operator". Think in terms of having deep specialty in one area, but learning skills from others and taking a whole-team approach to designing and delivering systems and solutions.

Answer 2

Most of the data breaches come as a result of human error - social engineering, phishing, etc.

I think management should organize security education for everyone. I don't see testers needing to be extra responsible in this regard. If any team should be more responsible, it is the security team (if it exists).

So, let's make a parallel:

• Quality is everyone's responsibility - but testers have a special interest in quality and can/should perform some sort of quality advocacy.
• Security is everyone's responsibility - but security experts have a special interest in security and can/should perform some sort of security advocacy.

Answer 3

All aspects of a product, whether they are features, performance or security are responsibility of the whole team. However, the roles and responsibilities for delivering the product by fulfilling all its aspects are delegated across the team.

• Deciding upon what all security measures need to be implemented for the project becomes responsibility of the product owner/architect/lead.
• Developers take up the role of implementing the decided upon security measures.
• The testers make sure that the security aspect is asserted based on respective security tests/checks.
• DevOps, on the other hand, are responsible that all aspects are fulfilled in the product release life-cycle.

However, that being said, we all are human, so intra-team feedback system is necessary to make sure updates are being made to the security measures already taken. Below security testing services links might be of some use,

https://blog.qasource.com/security-as-a-service

https://blog.qasource.com/protecting-yourself-from-common-security-shortfalls/

https://blog.qasource.com/cyber-security-testing-checklist

Answer 4

Properties of the product like security, reliability, and quality are the job of the entire team, not just one department.

I was recently reading Lessons Learned in Software Testing and would like to highlight three lessons from chapter 1.

Lesson 4: "Your group's mission includes (or should include) informing clients about anything that threatens the value of the product, according to your clients' definition of value." (Emphasis in original).

Lesson 11: You don't assure quality by testing. "It's all too easy to think of yourself as the guardian of quality. But you don't create quality, and you don't take it away... you can't [do your job] well if you give the impression that you think you're the only one on the product who cares about shipping a good product."

Lesson 13: Beware of the not-my-job theory of testing. "All other things being equal, your mission should be to inform the team, to the best of your ability, about any problems that could adversely impact the value of the product."

Security holes are certainly a "problem that could adversely impact the value of the product." That being said, security testing is absolutely part of the QA process. Obviously, you won't actually be able to find all potential security problems (and it's very dangerous to assume that you will), but don't take such a limited view of QA that you think that this kind of testing is entirely outside of your job.

Answer 5

Although Security Testing is the responsibility of the whole engineering team(QA/Dev/DevOps), a security expert team will be the most suitable choice to ensure the security aspects of the project.

Security testing services in the IT industry are equipped with the latest tools and technologies. They have the expertise to ensure that the application is rigorously tested for all possible threats and vulnerabilities, followed by implementing all the measures to make the product more secure.

Sometimes, testers do not have thorough knowledge about the different security issues that could occur or how to generate various breaches. So, selecting a security expert team will be the best choice.

Answer 6

In my opinion, security testing is not a one-man or one-team’s job. It needs testers and developers to come together when an organization needs to create a product that is secure and easy to use. Since testing is a part of the software development lifecycle, developers when working on the build should have their entire focus on any security issues that testers might have to face at the later stages of the lifecycle.

Though most organizations that collaborate well with QA company often have a well-defined process to handle security testing, the struggle usually comes to the teams that have minimum or no experience managing the integrated QA operations into their existing development environment.