CT-STE — Security Test Engineer glossary

161 terms the exam expects you to know, defined in plain language.

A

APKTool(apktool): A reverse engineering tool used to decompile Android APK files and inspect their contents.
Abuse Case(abuse cases, abuse case): A sequence of actions a malicious actor performs to harm the system, derived from use cases by considering misuse.
Abuse Cases(abuse cases): A security test design technique that describes how an attacker might exploit a system.
Abuse/misuse case development(abuse/misuse case development, abuse case development, misuse case development): The second step in security test design, following threat modeling and preceding selection of design techniques.
Acceptance Criteria for Security Testing(acceptance criteria, acceptance criteria for security testing, security acceptance criteria): Criteria defined in terms of residual risk levels that determine when a release is considered secure enough, e.g., no critical vulnerabilities.
Accepted Risk Statement(accepted risk statement): Documentation included in a report when a vulnerability cannot be fully remediated and the risk is formally accepted.
Actionable security findings(actionable results, developer-friendly findings): Security results reported in a format developers can understand and prioritize, often integrated with issue trackers.
Annex A.12.6.1(a.12.6.1): ISO/IEC 27001 control for management of technical vulnerabilities through security testing.
Annex A.14.2.1(a.14.2.1): ISO/IEC 27001 control for secure development policy requiring security testing.
Attack Tree(attack tree): A graphical representation of attack scenarios with a root node for the attacker's goal and child nodes for sub-goals, often using AND/OR logic.
Attack Trees(attack trees, attack tree): A graphical representation of attack scenarios with a root node for the attacker's goal and child nodes for sub-goals, used to identify attack paths.
Attack Vector(attack vector, high-risk attack vectors): A path or means by which an attacker can gain unauthorized access to a system or data.

B

Base Metrics(base metrics): CVSS metrics that rate exploitability and impact of a vulnerability independent of time or environment.
Binary Analysis: The process of inspecting the compiled app binary for hardcoded secrets, insecure configurations, or other hidden vulnerabilities.
Black-box Testing(black-box testing): A security testing technique where the tester has no knowledge of the internal structure or implementation details of the target system.
Broken Access Control(broken access control): A security risk category where attackers access resources or functions that should be restricted.
Business logic vulnerabilities(business logic vulnerabilities, logic flaws): Vulnerabilities that arise from flaws in the application's business rules and logic.

C

CI/CD Security Testing Pipeline(continuous integration/continuous delivery pipeline, ci/cd pipeline): An automated pipeline that triggers security testing stages on code changes for continuous security validation.
CI/CD pipeline integration(ci/cd pipeline, ci/cd integration, sca integration in ci/cd, continuous monitoring): The practice of embedding SCA scans into continuous integration and delivery workflows for early vulnerability detection.
CI/CD pipeline security gate(pass/fail gate, security gate): A pass/fail mechanism in a pipeline that blocks builds based on severity of security findings.
CVSS(common vulnerability scoring system, cvss score): A standardized framework for rating the severity of vulnerabilities using base, temporal, and environmental metrics.
CVSS Base Score(base score): The most commonly used CVSS metric group, derived from exploitability and impact for initial prioritization.
CVSS Environmental Metrics(environmental metrics): Metrics that consider the impact on your system to adjust the CVSS score based on context.
CVSS Score Threshold(cvss score, cvss threshold): A measurable threshold for vulnerability severity, often used in acceptance criteria (e.g., no critical or high-severity vulnerabilities with CVSS ≥ 7.0).
Certificate Validation: The process of verifying that an app's TLS/SSL connection uses a trusted certificate and does not accept self-signed or invalid certificates.
Client-Side Vulnerability: A security flaw residing in the mobile app itself, as opposed to the server-side API, often exploitable via local access.
Cloud Configuration Review(configuration review): The practice of inspecting cloud resource settings to detect misconfigurations.
Common Vulnerabilities and Exposures(cve): An identifier system for publicly known cybersecurity vulnerabilities used in the NVD.
Common Vulnerabilities and Exposures (CVE)(cves, cve): A list of publicly disclosed cybersecurity vulnerabilities that SCA tools report against.
Common Vulnerability Scoring System (CVSS)(cvss scores, cvss, common vulnerability scoring system): A standardized framework for rating the severity of security vulnerabilities.
Concept Distinction(closely related concepts): The differentiation of closely related testing terms such as severity vs priority or validation vs verification.
Configuration Review(configuration review): An examination of cloud resource settings (e.g., permissions, encryption) for misconfigurations.
Context-Dependency in ISTQB Answers(context dependency, it depends): The principle that ISTQB answers often depend on the given context, avoiding universal 'better' claims.
Context-specific security testing(context-specific security testing, security testing context): A testing approach that tailors security testing to the project's technology, risk, and regulatory environment.
Continuous Security Testing(continuous testing, continuous security testing): An ongoing security assessment approach to keep pace with dynamic cloud environments.
Cryptographic Failures(cryptographic failures): A security risk category related to weaknesses in encryption or data protection.

D

DAST(dynamic analysis, dast, dynamic application security testing): A security testing technique that tests the running application.
DREAD(dread): A risk assessment model prioritizing threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability using scored criteria.
Data Anonymization: The process of removing or obfuscating personal identifiers while preserving data structure for testing.
Data Anonymization and Masking(anonymized, masked, data anonymization, data masking): A technique to remove or obfuscate sensitive information while preserving data structure for testing.
Dynamic Analysis(dynamic analysis): A security testing method that observes app behavior during runtime to identify vulnerabilities such as insecure data handling.
Dynamic Application Security Testing (DAST)(dast tools, dynamic analysis, dast, dynamic application security testing): A security testing method that analyzes a running application to find vulnerabilities.

E

Environmental Metrics(environmental metrics): CVSS metrics that adjust score based on business impact and asset criticality.
Executive Summary(executive summary): A high-level section of a security test report intended for non-technical stakeholders.

F

False Positives in SCA(false positives): Incorrect vulnerability reports from SCA tools when the vulnerable code path is not actually used.
False positive suppression(false positive management, suppress false positives): The process of identifying and suppressing known false positives in security tool results to reduce alert fatigue.
Fuzz Testing(fuzz testing, fuzzing): A security testing technique that inputs invalid or unexpected data to find vulnerabilities during the testing phase.
Fuzzing(fuzzing, fuzz testing): An automated black-box test design technique that injects invalid or random data into a system to trigger failures and vulnerabilities.

G

Generation-based fuzzing(generation-based, generation-based fuzzing): A type of fuzzing that creates inputs from a model of the protocol or file format.
GitLeaks(gitleaks): A tool for detecting hardcoded credentials in git repositories and files.
Grey-box Testing(grey-box testing): A security testing technique where the tester has partial knowledge of the internal structure, often combining aspects of black-box and white-box testing.

H

Hardcoded Credentials(hardcoded credentials): The practice of embedding API keys, tokens, or passwords directly in the app binary, which attackers can extract via reverse engineering.

I

IAM Testing(identity and access management testing, iam testing): Security testing that validates user roles, policies, and permissions for least privilege.
IAST(interactive analysis): A security testing technique that combines both SAST and DAST approaches.
ISO/IEC 27001(iso 27001): International standard specifying requirements for establishing, implementing, and improving an ISMS.
ISTQB Glossary(istqb glossary, glossary): The official vocabulary reference for ISTQB exams, providing canonical definitions for terms.
ISTQB Sample Exam Bundle(sample exam and answer key bundle): A practice resource including a sample exam, answer key, and rationale document for CT-STE preparation.
Information Security Management System(isms): A framework of policies, procedures, and controls to manage information security risks.
Injection(injection, sql injection, nosql injection, os command injection): A security risk category where attackers insert malicious input (e.g., SQL, NoSQL, OS commands) into an application.
Insecure Communication: A vulnerability where mobile app network traffic lacks proper TLS/SSL encryption or certificate validation, allowing interception.
Insecure Data Storage: A mobile security vulnerability where sensitive data is stored without encryption in local storage like SharedPreferences, NSUserDefaults, or SQLite databases.
Interactive Application Security Testing (IAST)(iast, interactive application security testing): A security testing method that combines static and dynamic analysis for real-time vulnerability detection.

M

Manual testing(manual testing, manual techniques): A security testing technique performed by humans to find logic flaws and business logic vulnerabilities.
Measurable Security Thresholds(measurable thresholds): Quantifiable conditions for security requirements, such as maximum allowed CVSS score or number of critical vulnerabilities.
Misuse Case(misuse cases): An inverted use case diagram element showing actions the system should prevent, associated with a threatened use case.
Misuse Cases(misuse cases): A security test design technique that describes how a legitimate user might accidentally cause a security issue.
Mobile Top 10(mobile top 10, owasp mobile top 10): A list of the ten most critical mobile application security risks published by OWASP.
Mobile security tool(mobile security tools): A tool category designed to test mobile applications for vulnerabilities, for example MobSF.
Mutation-based fuzzing(mutation-based, mutation-based fuzzing): A type of fuzzing that modifies existing valid inputs to create test cases.

N

NVD Update Delay(delay, not real-time): The time lag between CVE publication and its inclusion in the NVD database.
National Vulnerability Database(nvd): A US government repository of standards-based vulnerability management data maintained by NIST.
National Vulnerability Database (NVD)(national vulnerability database, nvd): A US government repository of standards-based vulnerability management data used for reference by SCA tools.
Negative Test(negative test): A test designed to exploit known weaknesses or vulnerabilities to ensure system resilience.
Negative Testing(negative testing): A test design technique that focuses on invalid inputs and error conditions to ensure the system behaves as expected under adverse circumstances.
Network security scanner(network security scanners): A tool category that scans network infrastructure for vulnerabilities, such as Nmap and Nessus.

O

OWASP Mobile Top 10(owasp mobile top 10): A standard awareness document for mobile security that lists the top ten most critical risks, including insecure data storage.
OWASP Top 10(owasp top 10, top 10, owasp top 10 web application security risks): A standard awareness document that lists the most critical web application security risks.
Obfuscation(obfuscation): Encoding or hiding credentials in a way that is not a security control and can be easily reversed.

P

PASTA(pasta, pasta threat modeling methodology, pasta threat modeling process, process for attack simulation and threat analysis, pasta threat modeling): A threat modeling methodology that stands for Process for Attack Simulation and Threat Analysis.
PASTA Threat Modeling Methodology(pasta, process for attack simulation and threat analysis): A seven-step methodology that aligns business objectives with technical requirements to identify high-risk attack vectors.
Plan-Do-Check-Act cycle(pdca cycle): A continuous improvement cycle mapped to security testing phases for ISMS integration.
Platform-Specific Vulnerabilities(platform-specific vulnerabilities): Security weaknesses unique to Android or iOS, such as insecure WebViews on Android or improper Keychain use on iOS.
Principle of Least Privilege(principle of least privilege): A security principle granting users only the permissions necessary for their tasks.
Priority(priority): An attribute indicating the order for remediation of a vulnerability, distinct from severity.
Process Steps(process sequences): Ordered sequences of activities in testing methodologies like threat modeling or penetration testing.
Process sequences(process sequences, process sequence): The ordered steps enumerated in the syllabus, often tested with 'which step comes next?' questions.
Production Environment Replication(representative replica, replicate the production architecture, production environment replication): The practice of replicating production architecture, network topology, and components in a test environment for valid security results.

R

Residual Risk(residual risk): The risk remaining after vulnerability remediation, which may be formally accepted if full fix is not possible.
Residual Risk Level(residual risk level): The amount of risk remaining after security testing, used to define acceptance criteria such as no critical or high-severity vulnerabilities.
Retesting(retesting): The phase of verifying that vulnerability fixes are effective and do not introduce new issues.
Reverse Engineering(reverse engineering): Using tools like APKTool or JD-GUI to decompile applications and extract embedded secrets.
Risk Analysis(risk analysis): The process of evaluating the likelihood and impact of identified threats as part of PASTA.
Risk assessment versus security testing: Risk assessment identifies controls; security testing validates those controls' effectiveness.
Risk-Based Security Test Design(risk-based security test design, risk-based test design): A technique that prioritizes test cases based on the likelihood and impact of security risks, focusing effort on highest-risk areas.
Risk-Based Test Design(risk-based test design, risk-based security test design): A testing approach that focuses effort on the highest-risk areas.
Risk-based test prioritization(risk-based test prioritization): A testing strategy that prioritizes test cases based on the level of risk they address.
Rooted/Jailbroken Device Testing(rooted/jailbroken testing, jailbroken testing, rooted testing, rooted device testing, jailbroken device testing): Testing mobile apps on devices with escalated privileges (root on Android, jailbreak on iOS) to uncover vulnerabilities only present in compromised environments.
Runtime Application Self-Protection (RASP)(rasp, runtime protection, runtime application self-protection): A security technology that provides runtime protection by monitoring and blocking attacks within an application.

S

SAST(sast, static application security testing): An automated testing tool that analyzes source code for security vulnerabilities.
SDLC Integration of Security Testing(sdlc integration of security testing): The embedding of security testing activities throughout the software development lifecycle to enable early detection and continuous assessment.
SDLC Phases for Security Testing(sdlc phases, sdlc stages): The stages of the software development lifecycle (requirements, design, implementation, testing, deployment, maintenance) each with specific security testing activities.
STRIDE(stride, stride threat categorization model, stride threat model): A threat categorization mnemonic for six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Secure Enclave: A hardware-based security component in iOS devices that stores cryptographic keys and performs operations isolated from the main processor.
Security Acceptance Criteria(security acceptance criteria): Measurable conditions that define when a security requirement is met, used during the requirements phase.
Security Requirements(security requirements): Explicit security criteria defined during the requirements phase, including abuse cases and acceptance criteria.
Security Test(security test): A test designed to evaluate system security by identifying vulnerabilities.
Security Test Analysis and Reporting(security test analysis and reporting): The evaluation of test results and the documentation of findings, including vulnerabilities and remediation recommendations.
Security Test Design(security test design): A syllabus chapter covering threat modeling, abuse cases, and design techniques, weighted 15% on the exam.
Security Test Environment Isolation(environment isolation, test environment isolation): A principle requiring that test environments be separate from production to prevent accidental damage or data leakage.
Security Test Implementation and Execution(security test implementation and execution): A syllabus chapter covering the execution of security tests, weighted 15% on the exam.
Security Test Planning(security test planning): The process of translating the security test strategy into a detailed plan for specific test cycles, including effort estimation, scheduling, and resource assignment.
Security Test Report(security test report): A structured document that includes an executive summary, findings, risk ratings, and recommendations tailored to different audiences.
Security Test Strategy(security test strategy): A documented high-level plan that defines the overall approach, scope, resources, and alignment with organizational risk management for all security testing efforts.
Security Testing Tools(security testing tools): Software and utilities used to automate or support security testing tasks, such as vulnerability scanners and penetration testing tools.
Security Testing as Part of an ISMS(security testing as part of an isms): The integration of security testing activities into an organization's Information Security Management System (ISMS).
Security test strategy alignment(alignment with security test strategy): The requirement that tool integration must align with the overall security test strategy and organizational risk profile.
Security testing as control validation: A tool to verify that implemented security controls are effective, not a substitute for risk assessment.
Security testing integration with ISMS: Alignment of testing activities with ISMS risk management to validate control effectiveness.
Security testing tool selection criteria(tool selection criteria): Factors such as application type, testing phase, depth, team skill, licensing, and false positive rate that guide tool choice.
Security tool configuration and tuning(tool tuning, tool configuration): The adaptation of security tools to match the technology stack and avoid false positives while maintaining developer productivity.
Severity(severity): A measure of the impact of a vulnerability, distinct from priority which indicates remediation order.
Severity vs Priority(severity, priority): Severity is the impact of a defect, while priority is the urgency for fixing it, often confused in testing.
Shared Responsibility Model(shared responsibility model): A security framework dividing responsibilities between cloud provider and customer.
Shift-left Testing(shift-left testing, shift left testing, shift-left): The practice of integrating security testing early in the software development lifecycle to detect vulnerabilities sooner and reduce remediation costs.
Shift-left security testing(shift-left, shift-left testing, shift-left in security testing): A practice of integrating security testing early and continuously in the software development lifecycle to reduce cost and improve security.
Software Bill of Materials(sbom): A formal record containing details and supply chain relationships of components used in building software.
Software Bill of Materials (SBOM)(sbom, software bill of materials): A formal record containing details and supply chain relationships of components used in building software.
Software Composition Analysis(sca, sca tools): An automated process that identifies open source components in a codebase and checks for known vulnerabilities.
Software Composition Analysis (SCA)(sca, software composition analysis): A security testing method that analyzes open-source components and libraries for known vulnerabilities.
Software Composition Analysis Tool(sca tool, sca): A tool that scans dependencies against vulnerability databases like NVD to flag vulnerable components.
Software supply chain security(supply chain security): The management of security risks arising from third-party and open-source components used in software development.
Specific Security Test Topics(specific security test topics): A syllabus chapter covering specialized security testing areas, weighted 15% on the exam.
Standards, Regulations, and Compliance(standards, regulations, and compliance): The set of external requirements and guidelines that security testing must adhere to, including industry standards and legal regulations.
Static Application Security Testing(sast, static analysis): A security testing methodology that analyzes source code for vulnerabilities without executing the program.
Static Application Security Testing (SAST)(sast tools, static analysis, sast, static application security testing): A security testing method that analyzes source code without executing it to find vulnerabilities.
Syllabus Learning Objectives(learning objectives): Documented knowledge levels and topics that guide exam content and study focus.
Synthetic Data Generation(synthetic data): The creation of artificial data that simulates realistic scenarios without exposing real sensitive information.

T

Temporal Metrics(temporal metrics): CVSS metrics that incorporate factors like patch availability that change over time.
Test Environment Access Control(restrict access with firewalls and vpns): Measures like firewalls and VPNs to restrict access to test environments from the internet.
Test Environment Documentation(document the environment configuration): The practice of thoroughly documenting environment configuration for test reproducibility and traceability.
Test Environment Requirements(test environment requirements): Conditions and setups needed for security testing, including environments that mimic production systems to ensure realistic results.
Test Level and Test Type (ISTQB)(test level vs. test type): Test levels are phases like unit or integration; test types are objectives like functional or non-functional testing.
Test Manager Role Distinction (ISTQB)(test manager vs. test management role): The difference between the specific 'test manager' role and the broader 'test management role' that may involve multiple people.
Threat Modeling-Based Test Design(threat modeling-based test design): A technique that translates identified threats (e.g., from STRIDE) into test cases covering positive and negative scenarios.
Threat and vulnerability prioritization(understanding threats, vulnerabilities, and risks in context): The process of understanding threats, vulnerabilities, and risks in context to prioritize and report findings effectively.
Threat modeling(threat modeling): The first step in security test design, followed by abuse/misuse case development.
Threat vulnerability risk analysis(risk analysis): The process of understanding threats, vulnerabilities, and risks in context to prioritize and report findings effectively.
Tool integration placement(pipeline placement, tool positioning): The decision of where in the pipeline each security testing tool runs, such as SAST after build and DAST in staging.
Transitive dependency(transitive dependencies): A dependency of a direct dependency that can introduce hidden vulnerabilities into an application.
TruffleHog(trufflehog): A tool that scans code repositories and binaries for hardcoded secrets using pattern matching.

V

Validation(validation): A process that checks if a product meets user needs, as opposed to verification which checks specifications.
Validation and Verification (ISTQB)(validation vs. verification): Two distinct test activities: verification checks if requirements are met, validation checks if user needs are satisfied.
Validation vs Verification(validation, verification): Validation checks if the product meets user needs, verification checks if it meets specifications; commonly confused.
Verification(verification): A process that checks if a product meets specifications, as opposed to validation which checks user needs.
Vulnerability Closure(closure): The process of documenting retest results and obtaining acceptance of any remaining residual risk.
Vulnerability Intelligence(vulnerability intelligence): Data about vulnerabilities from sources like NVD used to inform test prioritization.
Vulnerability Reporting Process(vulnerability reporting process): A documented procedure for reporting security findings, retesting after fixes, and communicating with developers for timely remediation.
Vulnerability Severity Prioritization(severity scores, prioritize remediation): The use of CVSS scores to rank vulnerabilities for remediation efforts.

W

Web application scanner(web application scanners): A tool category focused on testing web applications for security flaws.
White-box Testing(white-box testing): A security testing technique where the tester has full knowledge of the internal structure, code, and design of the target system.

Z

Zero-Day Vulnerability(zero-day vulnerability, zero-day): A vulnerability that is unknown to the vendor and has no patch, potentially not in NVD yet.