1. Security Testing The importance of security testing
Security vulnerabilities
Are we secure ?  How much security testing WE DO ?
Security testing software tools
Starting directions in developing security testing

2. The importance of security testing
System testing is a must to identify and address web application security vulnerabilities to avoid any of the following:
A permanent loss in customer confidence
Damage company brand
Website downtime, devastating productivity
Expensive vulnerability remediation costs
Cost associated with securing web applications against future attacks
Legal sanctions and civil lawsuits, depending on the case in question

3. Secure application checklist:
Confidentiality – only those with authorized access
Integrity – information providing is correct
Authentication – establishes the identity of the user
Authorization – perform an action for which he has permission
Availability – ready for use when expected
Non-repudiation – information exchange with proof

4. Security vulnerabilities
Cross-Site Scripting (XSS)
Buffer Overflow
SQL Injection
Denial of Service
Password cracking
Data Manipulation
Unauthorized Data Access
URL Manipulation through HTTP GET methods

5. Security testing example
SQL Injection
Google search for inurl:.php?id=

6. Are we secure ?  How much security testing WE DO ?

7. OWASP

8. Tools for scanning this vulnerabilities:
WEB APPLICATION RISK
SECURITY UTILITY
A1: Injection
SQL Inject Me and Zed Attack Proxy (ZAP)
A2: Broken Authentication and Session Management
ZAP
A3: Cross-Site Scripting (XSS)
A4: Insecure Direct Object References
HTTP Directory Traversal Scanner, Burp Suite and ZAP
A5: Security Misconfiguration
OpenVAS and WATOBO
A6: Sensitive Data Exposure
Qualys SSL Server Test
A7: Missing Function Level Access Control
OpenVAS
A8: Cross-Site Request Forgery (CSRF)
Tamper Data (Samurai WTF), WebScarab or ZAP
A9: Using Components with Known Vulnerabilities
A10: Unvalidated Redirects and Forwards

9. Penetration Testing Simulating Attack from a Malicious Source
Includes Network Scanning and Vulnerability Scanning
Simulates Attack from someone Unfamiliar with the System
Simulates Attack by having access to Source Code, Network, Passwords

10. Security testing software tools:
OWASP ZAP
Metasploit
Nessus Vulnerability Scanner
Nmap
SQLmap
W3af
Burp Suite
CORE Impact

11. ZAP Report

12. My starting directions in developing security testing
What is security testing ?
What are the most common security attacks, technologies, tools ?
Detect vulnerabilities in your software application
Find the right tool that can be used to scan vulnerabilities
Write Security testing plan
Execute security scan
Report the threats and recommendations

13. Starting directions in developing security testing
Study of Security Architecture
Analysis of Security Requirements
Classifying Security Testing
Developing Objectives
Threat Modeling
Test Planning
Execution
Reports

14. Thank You