Introduction to Security & Compliance Testing

The course is technical, but this lesson isn’t! Just bear with us. 

Five buildings, five stories. The greatest inspector is taking care of unveiling the biggest failures of his life (Yes, we are talking real buildings). 

Building 1: Collapsed after a fire. The blueprints were perfect, the architecture stunning, but cheap wiring ignited the blaze. It was a supply chain weakness – a single bad component brought everything down. Inspecting all components was the only solution. 

Building 2: The Building had thinner walls than needed. Who needs walls anyway? Well, everyone!  This was a design flaw – a weakness present before construction even began, easily caught with proper design checks (here, designs and blueprints represent the written code even before the deployment is completed)

Building 3: Used top-tier materials and a flawless design, but collapsed during a minor earthquake. The builders neglected the soil analysis, a critical infrastructure oversight. Security requires a strong foundation, not just secure walls. A complete real-world testing simulation would have caught this weakness. 

Building 4: Stood tall and strong for years, but remains empty. Why? The building walls were too transparent – even the bathrooms were transparent. This represents a privacy violation – strong security doesn’t matter if you fail to protect sensitive data.

Building 5: Secure, private, and perfectly built… until government officials seized it on opening day. The builders used unlicensed materials and unlawfully obtained land. This is a Compliance Failure – even the best security is worthless if you break the rules.

Taking these scenarios in the Software world, a weakness is called a vulnerability, using this vulnerability to cause harm or collapse a building is called “Exploit”.

The first building collapsed due to a problem in a component. Testing components in the software world is called Software Composition Analysis. A field of AppSec that detects if any dependency is vulnerable. And this isn’t an intrusive test, a list of all components or dependencies is more than enough to complete the analysis. And just like one faulty wire can take the building down, one vulnerable component can get an app hacked. 

The second building had design issues; the Engineer designing it didn’t use enough walls. To detect that, a look at the designs even before the building was enough to know the risks. Such a test in the software world is called Static Application Security Testing (SAST). Another non-intrusive test that needs only code to assess, even before deploying the building/the software. 

The third building was never tested in a simulation environment, so it collapsed due to a minor earthquake. A real-world intrusive or semi-intrusive test where testers get into the building and try to see if there is a security risk somewhere is called Dynamic Application Security Testing (DAST), which is more intrusive than the other types, as it requires a complete building or a simulation building to assess. DAST deals with apps as black box, simulating attacks to see if it is strong enough or not.

The fourth building was fine, from a technical standpoint, it’s strong, but from a legal standpoint, it makes private information either more available than it should or by not allowing users to control and even delete their data. This kind of weakness isn’t a security vulnerability, as it won’t cause the building to fully or partially collapse. In the software world, compliance to privacy laws like GDPR, HIPAA, CCPA, ePrivacy, and others is as important as security testing. 

The 5th building represents a software that used unlicensed software, pirated components, and non-compliant open-source dependencies to build the final software. Another huge mistake usually seen in the software world. A License Assessment would have detected and fixed this issue. Although this doesn’t affect users directly, nor the security of the building, but it’s worse as it represents a ticking legal and reputational time bomb. The consequences could range from hefty fines and lawsuits to irreparable damage to the company’s brand and loss of customer trust.

Each failure represents one type of security or compliance risk, compiled in the table below:

In the remainder of this course, we will take each assessment type, dive deeper into what it represents, and how to perform the test and fix any findings.