Page 106 - SOFTWARE TESTING & QUALITY ASSURANCE

Unit 7: Documentation and Security Testing

In a network system the tester identifies the threats such as network threats,
host threats, application threats, and so on.
Document the Threats
The tester will use a common document or template to record all the threats that he/she has detected in
the system. A typical template consists of:
1. Threat Description: It defines the threat that has been detected.
2. Threat Target: It specifies the actual target of the attacker.
3. Risk: This is used to mention the priority based on the criticality of the risk.
4. Attack Techniques: These are the techniques that are used by the attackers to carry out the attack.

5. Attack Techniques: These are the techniques that are used by the attackers to carry out the attack.
The tester has detected two threats in the system which he/she has to
document. The figure 7.8 shows the template that the tester uses to record the
threat he/she has detected. The template has five rows which are threat
description, threat target, risk, attack techniques, and counter measures.
Figure 7.8: Template to Record Threat

Source: http://msdn.microsoft.com/en-us/library/aa302419.aspx

At this level the risk column is left empty since the risk ratings are given in next
level based on the criticality of the risk.

LOVELY PROFESSIONAL UNIVERSITY 99