security-testing-patterns（安全测试模式）

Security Testing Patterns

Expert guidance for implementing comprehensive security testing strategies including static analysis, dynamic testing, penetration testing, and vulnerability assessment.

When to Use This Skill

• Implementing security testing pipelines in CI/CD
• Conducting security audits and vulnerability assessments
• Validating application security controls and defenses
• Performing penetration testing and security reviews
• Configuring SAST/DAST tools and interpreting results
• Testing authentication and authorization mechanisms
• Evaluating API security and compliance with OWASP standards
• Integrating security scanning into development workflows
• Responding to security findings and prioritizing remediation
• Training teams on security testing methodologies

Core Concepts

Security Testing Pyramid (Layered Approach)

1. Unit Security Tests - Test security functions (encryption, validation)
2. SAST - Static analysis during development
3. SCA - Dependency and component vulnerability scanning
4. DAST - Dynamic testing in running applications
5. IAST - Interactive analysis combining SAST and DAST
6. Penetration Testing - Manual security testing by experts
7. Red Team Exercises - Adversarial simulation testing

Testing Categories

Static Testing (SAST)

• Analyzes source code without execution
• Early detection in development lifecycle
• Complete code coverage
• High false positive rates

Dynamic Testing (DAST)

• Tests running applications
• Detects runtime and configuration issues
• Language agnostic
• Requires deployed environment

Composition Analysis (SCA)

• Scans dependencies for vulnerabilities
• Tracks license compliance
• Automated remediation options

Manual Testing

• Penetration testing
• Business logic validation
• Complex attack scenarios

Quick Reference

Security Testing Workflow

Phase 1: Planning

1. Define security requirements and threat model
2. Select appropriate testing tools and techniques
3. Establish baseline security posture
4. Set severity thresholds and acceptance criteria

Phase 2: Automated Testing

1. SAST - Integrate into IDE and CI/CD pipeline
2. SCA - Configure dependency scanning (npm audit, Snyk, Dependabot)
3. DAST - Schedule scans against deployed environments
4. Container Scanning - Scan Docker images (Trivy, Aqua)

Phase 3: Manual Testing

1. Authentication and authorization testing
2. Business logic vulnerability assessment
3. API security testing (OWASP API Top 10)
4. Penetration testing and exploitation

Phase 4: Analysis and Remediation

1. Triage findings by severity and exploitability
2. Eliminate false positives
3. Prioritize remediation based on risk
4. Track vulnerabilities to resolution
5. Verify fixes with regression testing

Phase 5: Continuous Monitoring

1. Monitor for new vulnerabilities in dependencies
2. Re-scan after code changes
3. Conduct periodic penetration tests
4. Update security baselines and policies

Common Mistakes

Tool Selection

• Wrong: Using only SAST or only DAST
• Right: Layered approach combining multiple testing types

False Positive Management

• Wrong: Ignoring or suppressing findings without review
• Right: Systematic triage process with security team validation

Integration Timing

• Wrong: Security testing only before release
• Right: Continuous security testing throughout development

Scope Definition

• Wrong: Testing only main application code
• Right: Include dependencies, APIs, infrastructure, and third-party integrations

Remediation Priority

• Wrong: Fixing all findings equally
• Right: Risk-based prioritization (severity × exploitability × business impact)

Authentication in Testing

• Wrong: DAST scans without authentication
• Right: Configure authenticated scanning to test protected features

Best Practices

1. Shift Left: Integrate security testing early in development
2. Continuous Testing: Automate security scans in CI/CD pipelines
3. Layered Approach: Combine SAST, DAST, SCA, and manual testing
4. Risk-Based Testing: Prioritize testing based on threat model
5. False Positive Management: Establish process for triaging findings
6. Remediation Tracking: Use SIEM/SOAR for vulnerability management
7. Regular Updates: Keep security tools and signatures current
8. Security Champions: Train developers in security testing
9. Metrics and KPIs: Track security posture over time
10. Compliance Validation: Map tests to regulatory requirements

Resources

• OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide/
• OWASP API Security: https://owasp.org/www-project-api-security/
• NIST SP 800-115: Technical Guide to Information Security Testing
• PTES: Penetration Testing Execution Standard
• SANS Security Testing: https://www.sans.org/security-resources/
• HackerOne Methodology: https://www.hackerone.com/ethical-hacker/hack-learn
• PortSwigger Academy: https://portswigger.net/web-security