Finding the right testing method

‍

Fifteen years ago there were few automated security tools to leverage and so manual testing was the prominent method for security testing. However, these days that's not the case. Automated testing tools like Burp Suite, SQL Map and Nessus Vulnerability Scanner can now perform, on average, 80% of manual capabilities. But that’s not to say automation has eradicated the need for manual tests. 

‍

The remaining 20% of manual processes have a stronghold within security testing strategies. For example, business logic flaws and authentication & access control weaknesses cannot be found by automated tests alone.  So instead of fearing the rise of automated tools, the most efficient security teams are finding the balance between automated and manual testing.  

‍

But how do you effectively prioritise which test to make and which method to use?

‍

Analysing the development change

‍

A useful place to start is the change log of the environment. Or, even better, the submitted pull request before the change takes effect. Here you can understand the types of changes being introduced and the most appropriate tests for them. For example, will the change likely introduce an SQL injection vulnerability or business logic flaw? As mentioned above, we know that a manual test would be the most appropriate approach for these. 

‍

This is important as, ultimately, this is where testing efficiency is maximised. Testing at the source and time of change means no context is lost. Moreover, understanding the capacity of your automated tools is key in quickly identifying what to test and which tool to use. The alternative is to blanket test without clear direction, risking vulnerabilities slipping through the net and time being wasted. 

‍

But how can you quickly assess each development change at scale?

‍

Classifying potential vulnerabilities

‍

To scale and automate this process, utilise technology to classify changes into ‘buckets’ based on the type of vulnerability likely to be introduced. This has really taken off in the last couple of years when LLM's  have become more prevalent. The result is an automated list of changes made, vulnerabilities that are likely to have been introduced, and an informed testing plan of automated or manual tests. This automatic  interpretation and classification of pull requests hugely reduces MTTD and prevents vulnerabilities from entering a live environment. 

‍

Summary

‍

There is a strong place for both automatic and manual tests to operate in unison. Companies can utilise technology to create a set of specific testing actions that highlight which test to use and where. 

‍

Testing earlier in the development process gives security teams a head start in finding vulnerabilities, makes them easier to fix and reduces the chance of unmanageable vulnerability backlogs.

‍