Types of Web Application Security Testing

Abstract

The purpose of web application security testing is to find any security weaknesses or vulnerabilities within an application and its environment, to document the vulnerabilities, and to explain how to fix or remediate them. The business drivers behind the testing may be requirements of corporate policy, security requirements mandated by the corporate financial auditors or an internal audit department, compliance requirements for PCI or other industry standards, or compliance with regulatory standards such as Sarbanes-Oxley or HIPAA. An evidentiary type of audit report, which contains evidence to back up claims of vulnerabilities, is even better, as the report will stand the test of time, and, over the years, explanations and thoughts about how the vulnerabilities were found may fade from people’s memories.