CT-SEC — Security Testing glossary

148 terms the exam expects you to know, defined in plain language.

A

Abuse Cases(abuse cases): Techniques that focus on malicious user behavior to uncover security vulnerabilities.
Architectural Risk Analysis(architectural risk analysis): An analysis of system architecture to identify and assess security risks.
Attack Surface(attack surface): The total set of vulnerabilities in a system, increased by each running service or installed application.
Authentication Testing(authentication, testing authentication, authentication testing): Testing to verify that the system correctly validates user identity.
Authorization Testing(authorization, testing authorization, authorization testing): Testing to ensure that users have appropriate access rights.
Automated Configuration Scanning(automated scanners, automated scanning): The use of tools to automatically check system configurations against security baselines.
Automated Security Scanning(automated scanners, automated tools, automated security scanning): The use of automated tools to scan configurations, which may produce false positives requiring manual verification.

B

Baiting(baiting): A social engineering attack that offers something enticing to trick victims into compromising security.
Black-Box Testing(black-box testing, black box testing): A testing approach where the internal structure of the system is unknown, relying on inputs and outputs.
Blame-Free Culture(supportive culture, culture that encourages reporting mistakes without blame): A supportive environment that encourages reporting mistakes without fear of punishment.
Brute Force Attack Testing(brute force): A test that checks the system's resistance to repeated login attempts with many password guesses.
Buffer Overflow Vulnerability(buffer overflow vulnerability): A vulnerability where a program writes beyond the allocated buffer, potentially allowing remote code execution.
Burp Suite(burp suite): A web application security testing tool used for intercepting and manipulating traffic.

C

CIS Benchmarks(cis): Security configuration guidelines from the Center for Internet Security.
Change Management Integration(integrated with change management): The integration of security test maintenance into the overall change management process to keep tests effective.
Code Review(manual code review, code review): A manual security testing activity where trained reviewers examine code to catch logic flaws and design issues missed by automated tools.
Common Vulnerabilities and Exposures(cve, common vulnerabilities and exposures): A system that assigns unique identifiers to specific vulnerabilities for tracking and reference.
Common Vulnerability Scoring System(cvss, common vulnerability scoring system): A widely adopted standard for assigning severity scores to vulnerabilities based on exploitability and impact.
Common Weakness Enumeration(cwe, common weakness enumeration): A taxonomy of software weaknesses that provides a common language for describing security vulnerabilities.
Compensating Controls(compensating controls): Alternative security measures used when a direct fix is not immediately possible to mitigate a vulnerability.
Complementary Security Testing(automated and manual review together, complementary security testing): The combined use of automated tools and manual review to achieve comprehensive vulnerability coverage.
Compliance Alignment(regulatory alignment): The requirement that security policies align with legal, regulatory, and contractual obligations.
Compliance Evaluation(compliance evaluation, evaluating compliance): The process of assessing whether security controls meet the requirements set by policies and procedures.
Configuration Drift(configuration drift): The deviation of system configurations from a secured reference image after deployment.
Configuration Review(configuration review): A check that system settings follow security baselines such as CIS or NIST.
Credential Stuffing Testing(credential stuffing): A test that checks the system's resistance to login attempts using stolen credentials from other breaches.

D

Defense in Depth Principle(defense in depth): A security strategy using multiple layers of controls to protect assets.
Design-Phase Security Testing(design-phase security testing, security testing at the design phase): Proactive security testing performed at the design stage to identify vulnerabilities early.
Dynamic Analysis(dynamic analysis): A security testing technique that tests a running application to find runtime vulnerabilities such as memory leaks or improper input validation.
Dynamic Analysis Tools(dynamic analysis tools): Tools that test a running application by sending inputs and observing outputs and behavior to find runtime vulnerabilities.
Dynamic Application Security Testing(dynamic application security testing, dast): A security testing technique that analyzes applications in runtime to identify vulnerabilities.
Dynamic Application Security Testing (DAST)(dast, dynamic application security testing): A specific form of dynamic analysis that probes an application from the outside, simulating attacker behavior without access to source code.
Dynamic Scanning(dynamic scanning): A security testing activity performed during testing phase using tools like OWASP ZAP.

E

Encryption Testing(encryption, encryption testing): Testing to confirm that data is properly encrypted in transit and at rest.

F

Forced Browsing Testing(forced browsing): A test that attempts to access restricted URLs directly without proper authorization.
Foundational Role of Security Policies(istqb security policy role): According to ISTQB CT-SEC, security policies define the scope and objectives of security testing activities.
Fuzzing(fuzzing): A black-box testing technique that injects invalid or unexpected inputs to trigger failures.

H

Human Factor in Security(human factor, human factor in security): The influence of people's behaviors and attitudes on the effectiveness of security measures and controls.
Human Factors(human factors): Human-related elements such as social engineering and lack of awareness that are significant security risks.
Human Factors Testing(human factors testing): Assessment of human-related vulnerabilities including social engineering simulations and policy adherence reviews.
Human Factors in Security Testing(human factors, human factors in security testing, human factor in security): Consideration of user behavior and social engineering in security testing.

I

ISO/IEC 27001(iso/iec 27001, iso/iec 27001): An international standard specifying requirements for an information security management system (ISMS).
ISO/IEC 27002(iso/iec 27002, iso/iec 27002): An international standard providing guidelines for security controls within an ISMS.
ISTQB CT-SEC Syllabus Learning Objectives(syllabus learning objectives, learning objectives): Defined knowledge levels and topics for the Certified Tester Security Testing exam.
ISTQB Glossary(istqb glossary): The authoritative source of terminology for all ISTQB exams.
Implementation-phase Security Testing(implementation phase testing, implementation-phase testing): Security testing performed during the implementation phase, including static analysis, dynamic analysis, and code review to detect flaws early.
Incident Reporting(incident reporting, incident reporting rate): The process of reporting suspicious activities or security incidents within an organization.
Information Security Policy(information security policy, security policy): A high-level document outlining an organization's approach to managing sensitive data and protecting information assets.
Input Validation Testing(input validation, input validation testing): Testing to check that the system rejects malformed or malicious input.
Insecure Direct Object References Testing(insecure direct object references (idor), idor): A test that checks for unauthorized access to resources by modifying object identifiers.
Insider Threat(insider threat): A security risk posed by individuals within the organization who may misuse their access.
Interactive Application Security Testing (IAST)(interactive application security testing): Tools that combine static and dynamic techniques by instrumenting the application to monitor code execution during tests.

L

Least Privilege Principle(least privilege): A security principle that grants users only the minimum permissions necessary to perform their tasks.

M

Maintenance Trigge(maintenance trigger): A system change that prompts security test maintenance to keep tests relevant.
Maintenance Trigger(triggered by system changes, maintenance triggers, maintenance trigger): A system change that should trigger security test maintenance, not just scheduled intervals.
Manual Testing Tools(manual testing tools): Tools that support human testers in performing in-depth security assessments, such as intercepting proxies and exploitation frameworks.
Manual Verification(manual review, manual verification): Essential human review of context-specific settings and scanner outputs to confirm findings.
Misuse Cases(misuse cases): Techniques that identify potential attack vectors by modeling unintended or malicious use of the system.
Multi-Factor Authentication Testing(multi-factor authentication (mfa) enforcement, mfa enforcement): A test that verifies the correct implementation and enforcement of multi-factor authentication.

N

NIST SP 800-115(nist sp 800-115, nist sp 800-115): A technical guide from NIST covering security testing and assessment processes.
NIST Standards(nist): Security standards published by the National Institute of Standards and Technology.
Nessus(nessus): A vulnerability scanning tool that identifies security issues in networks and systems.
Non-Functional Security Testing(non-functional aspects): Testing that addresses aspects like usability and performance that can impact security.

O

OWASP Testing Guide(owasp testing guide, owasp testing guide): A comprehensive framework published by OWASP for testing web application security.
OWASP Top 10(owasp top 10): A reference list of the most critical web application security risks.
OWASP ZAP(owasp zap): An open-source web application security scanner used for finding vulnerabilities during testing.

P

Password Policy Testing(password policies): A test that verifies the enforcement of password complexity, length, and expiration rules.
Patch Management Verification(patch management verification, patch verification): The process of verifying that all relevant security patches are applied to a system.
Penetration Testing(penetration testing, penetration tests): A controlled security attack simulation to identify exploitable vulnerabilities in a system.
Phishing(phishing): A social engineering attack using fraudulent emails to deceive recipients into revealing information or performing actions.
Phishing Simulation(phishing simulation): A controlled test using fake login pages or emails to measure user susceptibility without storing real credentials.
Physical Security Observation(physical security observation, observation of physical security): Checking for unlocked workstations or other physical security weaknesses.
Policy vs Procedure Distinction(policy and procedure difference): The difference between high-level mandatory policies and detailed operational procedures, critical for compliance evaluation.
Pretexting(pretexting): A social engineering attack that creates a fabricated scenario to obtain confidential information.
Priority(priority): An indicator of the urgency of fixing a defect, such as critical business need.
Privilege Escalation Testing(privilege escalation): A test that checks for unauthorized elevation of privileges, both vertical and horizontal.
Procedure in Security(procedure, procedures, security procedure): Step-by-step instructions that implement a security policy, detailing how to perform specific security tasks.

R

Regression Testing for Security Fixes(regression testing): Re-testing after a fix to ensure the vulnerability is resolved and no new issues are introduced.
Removal of Unnecessary Services(removal of unnecessary services): The practice of disabling or uninstalling services and software not required for system function.
Risk Appetite(risk appetite): The level of risk an organization is willing to accept, guiding security test strategy alignment.
Risk Assessment(risk assessment): A component that prioritizes testing based on threat modeling and business impact.
Risk Assessment in Security Testing(risk assessments): The process of evaluating the likelihood and impact of security vulnerabilities.
Risk Identification Techniques(core techniques for identifying risks): Methods used to identify potential risks in a project or system.
Risk Reassessment(reassessment of risks, periodic reassessment, risk reassessment): A periodic reassessment of risks to adjust the test suite based on newly discovered vulnerabilities like OWASP Top 10 updates.
Risk-based Test Prioritization(prioritize tests based on risk): The practice of prioritizing tests based on risk assessment to focus on the most critical vulnerabilities.
Role-Based Access Control Testing(role-based access controls (rbac), rbac): A test that verifies that users with different roles can only access permitted resources and actions.
Role-Specific Training(role-specific content, role-specific training): Training content tailored to different job roles to address their unique security needs.
Runtime Vulnerability(runtime vulnerability): A vulnerability that only manifests during execution, such as race conditions or resource leaks.

S

SDLC Integration(sdlc integration): Incorporating security activities throughout the software development lifecycle.
SDLC Integration of Security Testing(integrated throughout the sdlc, testing throughout sdlc, testing throughout the sdlc, sdlc integration, integration with sdlc, sdlc integration of security testing): The practice of incorporating security testing throughout the software development lifecycle.
Security Awareness(security awareness): A defense layer that reduces human-related vulnerabilities through training, policies, and culture.
Security Awareness Program(security awareness program, awareness program): A structured initiative combining training, testing, and culture to improve security behavior.
Security Awareness Training(security awareness training): A preventive control that educates employees to recognize and avoid security threats, especially social engineering.
Security Baseline(security baselines, baseline, security baseline): A set of minimum security standards, such as those from CIS or NIST, used for configuration review.
Security Control(security controls, controls, security control): A safeguard or countermeasure implemented to mitigate risk and protect information assets.
Security Controls Usability(security controls usability): The principle that security policies and controls must be designed to be usable to prevent users from bypassing them.
Security Culture(security culture): The human factor reflected in whether procedures are consistently followed, indicating organizational security awareness.
Security Culture Weakness(procedure adherence gap): A human factor where procedures are not followed in practice, indicating a weakness in security culture.
Security Design Review(security design review): An evaluation of system architecture against security principles such as least privilege and defense in depth.
Security Regression Testing(security regression testing, security regression tests): Re-testing of previously validated functionality to ensure that security fixes do not introduce new defects.
Security Requirements Analysis(security requirements analysis): The process of deriving security requirements from threat models and documenting them for traceability.
Security Risk(security risk): Potential harm from an exploited vulnerability affecting business operations.
Security Test Evaluation and Reporting(security test evaluation and reporting): An activity of providing remediation recommendations and verifying that remediation has been effective.
Security Test Maintenance(security test maintenance, maintenance activities): A defined activity within the security testing process that ensures test cases, test data, and test environments remain valid and effective over time.
Security Test Strategy(security test strategy): A high-level plan that defines the scope, approach, and objectives for security testing activities.
Security Testing Baseline(baseline, criteria, baseline for security testing, testing baseline, security testing baseline): The policies and procedures used as criteria to evaluate and test security controls for compliance and effectiveness.
Security Testing Mindset(different mindset than functional testing, security testing mindset): A focus on what could go wrong rather than just expected behavior.
Security Testing Policy(security testing policy): A set of guidelines and rules for conducting security testing across an organization, often defined by the test management role.
Security Testing Process(security testing processes, security testing process): A structured sequence of activities for performing security testing.
Security Testing Purposes and Strategy(security testing purposes and strategy): High-level goals and approach for conducting security testing.
Security Testing Strategy(security testing strategy, security testing purposes and strategy): A high-level approach to integrating security testing into the software development lifecycle, defined at the organizational level.
Security Testing Throughout the SDLC(security testing throughout the sdlc): An approach that integrates security testing activities across all phases of the software development lifecycle.
Security-focused Unit Testing(security-focused unit tests, unit testing with security test cases, security-focused unit testing): Unit test cases that include security scenarios like boundary conditions and invalid inputs to verify secure data handling of individual components.
Session Hijacking Testing(session hijacking): A test that verifies the system's resistance to attackers stealing or predicting session tokens.
Session Management Testing(session management): A test that verifies session tokens are random, expire after logout, and are not exposed in URLs.
Severity vs. Priority(severity vs. priority): Distinction between the impact of a defect and the urgency of fixing it.
Shift-Left Testing(shift-left testing): The practice of integrating security testing early in the SDLC to reduce the cost and impact of vulnerabilities.
Simulated Attack(simulated attacks): A technique to assess security awareness by mimicking real attacks to measure user response.
Smishing(smishing): A social engineering attack using SMS text messages to deceive recipients.
Social Engineering(social engineering): The psychological manipulation of people to perform actions or divulge confidential information.
Social Engineering Attack(social engineering): A manipulation technique that exploits human psychology to breach normal security procedures.
Social Engineering Simulation(social engineering simulation, simulated phishing email): A test that mimics social engineering attacks to evaluate an organization's susceptibility.
Social Engineering Test(social engineering testing): A planned and authorized simulation of social engineering attacks to assess security awareness and response.
Static Analysis(static analysis): A security testing activity performed during development to catch vulnerabilities early.
Static Analysis Tools(static analysis tools): Tools that examine source code, bytecode, or binary code without execution to identify potential security flaws.
Static Code Analysis(static analysis, static code analysis): A security testing technique that examines source code without execution to detect patterns indicating vulnerabilities like buffer overflows or SQL injection.
System Hardening(hardening, system hardening): The process of securing a system by reducing its surface of vulnerability.

T

Tailgating(tailgating): A physical social engineering attack where an unauthorized person follows an authorized person into a restricted area.
Test Case Update(updating test cases, test case updates, test case update): An activity that reviews and updates test cases when system requirements or architecture change, retiring obsolete tests and adding new ones for emerging threats.
Test Data Refresh(test data refresh, managing test data): An activity that refreshes test data to reflect current user roles and permissions, preventing false positives or negatives.
Test Environment Patching(environment patching, test environment patching): An activity that patches and reconfigures test environments to match production as closely as possible.
Test Level vs. Test Type(test level vs. test type): Different testing dimensions: test level refers to the stage of testing (e.g., unit, integration), test type refers to the objective (e.g., functional, non-functional).
Test Management Role(test management role): An organizational-level set of responsibilities including defining security testing strategies, establishing policies, and integrating security testing into the development lifecycle.
Test Manager(test manager): A specific person responsible for planning, controlling, and executing the test process in security testing at the project level.
Test Manager vs. Test Management Role(test manager vs. test management role): Two distinct roles: test manager oversees the test process, while test management role involves broader organizational responsibilities.
Test closure(test closure): The final phase of the testing process that includes verification of fixes and documentation of lessons learned to improve future security testing.
Tester's Role in Security Testing(tester's role): The responsibility of testers to think like attackers and collaborate on security validation.
Testing Techniques(testing techniques): Specified methods such as static analysis, dynamic analysis, and manual testing used in security testing.
Threat Modeling(threat modeling): A technique used to identify and prioritize potential threats to a system.
Tools and Standards in Security Testing(tools and standards): Instruments and frameworks used to support security testing activities.

V

Validation vs. Verification(validation vs. verification): Two distinct testing activities: validation checks if the product meets user needs, verification checks if it meets specifications.
Verification of Security Fixes(verification of fixes, re-testing): A process of re-testing vulnerabilities after remediation to confirm effectiveness and detect side effects.
Vishing(vishing): A social engineering attack using voice calls (phone calls) to deceive victims.
Vulnerability Lifecycle Tracking(vulnerability closure, closure tracking): A systematic tracking of vulnerabilities through states: open, in progress, fixed, verified, and closed.
Vulnerability Prioritization(prioritization based on risk): A process of ranking vulnerabilities based on risk, impact, and exploitability to determine order of remediation.
Vulnerability Remediation Planning(remediation planning): A process of proposing fixes, assigning timelines, responsible parties, and verification criteria for addressing vulnerabilities.
Vulnerability Scanning(vulnerability scanning): An automated technique to identify known vulnerabilities in a system.

W

White-Box Testing(white-box testing): A testing approach that examines internal code and structure to identify vulnerabilities.