download issue 24 here - Help Net Security

Selecting the right testing approach
Once an Application Criticality Matrix has
been established, you may opt to focus first
on those that, as a result of the assessment,
have been classified in the levels of High and
Critical. Now it is time to determine the kind of
testing that should be used, choosing between
a wide range of approaches:
• Depth vs. breadth. Penetration testing or
vulnerability assessment?
• Inside-out vs. outside-in. Do you want to
know the insider threat level or the outsider
one?
Table 1: Application Criticality Matrix.
• Timing. At what point(s) in the SDLC will the
assessment be performed? (Rule of thumb:
the earlier, the better)
• Manual, automated or “hybrid” testing?
To identify the best suited approach, OWASP,
a worldwide community focused on improving
security of application software, has published
the Application Security Verification Standard
(ASVS), which serves as a great starting
point. ASVS defines four levels of Web application
security verification: Automated, Manual
Review, Design Verification and Internal
Verification. Each level includes a set of requirements
for verifying the effectiveness of
security controls that are being used.
www.insecuremag.com 30