Here’s where things get a bit murky and kinky. There are two types of Security testing:
- Security testing (murky)
- Penetration testing (murky–)
Security testing
Security testing, more than not, overlaps with any other testing sans UI/UX. The goal of a security test is to discover if there’s weakness in the software that allow an attacker to either gain knowledge or control. The reason to have a separate category is that Security is its own domain.
Say your software allows for user input, the user can enter some data into some form and submit it. This data needs to be validated and sanitized before it goes anywhere. Why? Because OWASP top 10. Injection attacks in particular relay on lack of input sanitization and validation (and of course no special characters escaping).
Penetration testing
Penetration testing is subset of Security testing with the sole goal to penetrate a given system. Gaining unauthorized access, discovering buffer overflow issues, ability to upload malicious content are just few examples.
There’s much more to share but enough for now. The one thing to remember is that Security testing MUST be done at all costs. By far the easiest way to loose customer trust is not due functionality blockers but due stolen customer data and compromised system that can further the attack.