1. Home
  2. ISTQB® Advanced Security Tester Certification

ISTQB® Advanced Security Tester Certification

istqb-certification

  • Plan, perform and evaluate security tests from a variety of perspectives – policy-based, risk-based, standards-based, requirements-based and vulnerability-based
  • Align security test activities with project lifecycle activities
  • Analyze the effective use of risk assessment techniques in a given situation to identify current and future security threats and assess their severity levels
  • Evaluate the existing security test suite and identify any additional security tests
  • Analyze a given set of security policies and procedures, along with security test results, to determine effectiveness
  • For a given project scenario, identify security test objectives based on functionality, technology attributes and known vulnerabilities
  • Analyze a given situation and determine which security testing approaches are most likely to succeed in that situation
  • Identify areas where additional or enhanced security testing may be needed
  • Evaluate effectiveness of security mechanisms
  • Help the organization build information security awareness
  • Demonstrate the attacker mentality by discovering key information about a target, performing actions on a test application in a protected environment that a malicious person would perform, and understand how evidence of the attack could be deleted
  • Analyze a given interim security test status report to determine the level of accuracy, understandability, and stakeholder appropriateness
  • Analyze and document security test needs to be addressed by one or more tools
  • Analyze and select candidate security test tools for a given tool search based on specified needs
  • Understand the benefits of using security testing standards and where to find them
 
Who Should Attend?
  • Security Testers
  • Security Analysts
  • Project Managers
  • Test Automation Engineers
  • Cybersecurity Engineers
  • DevSecOps Engineers
  • Systems Engineers
  • Software Developers

ISTQB® Certification & Exam
The International Software Testing Qualifications Board (ISTQB) is the world's most widely-recognized certification of software testing skills and knowledge. Founded in 2002, the ISTQB is is a not-for-profit association that has issued more than 750,000 certifications in 129 countries around the globe. The ISTQB Software Tester Certification—Foundation Level (CTFL) is a prerequisite for the ISTQB Usability Testing (ISTQB CTFL-UT) exam. In order to be eligible to take this exam, potential examinees must submit proof of Certified Tester—Foundation Level (CTFL) certification.

For public virtual classes, the ISTQB Advanced Level – Security Tester (CTAL-SEC) exam is an additional fee and is not included in the course price. You have the option to add on this exam voucher when you register for the class. If you choose to add on the exam voucher, it will be emailed to you upon completion of the course. If you do not choose to add-on the voucher when purchasing this class, you must reach out to an exam provider directly if you wish to take an exam later.*

*This purchase does NOT fall under our Coveros guarantee of retaking the class if you do not pass the exam within 30 days of taking the class. This purchase includes just one (1) exam voucher. All additional vouchers will need to be purchased with an exam provider.

 

Course Outline
The Basis of Security Testing
Security Risks
  • The Role of Risk Assessment in Security Testing
  • Asset Identification
  • Analysis of Risk Assessment Techniques
Information Security Policies and Procedures
  • Understanding Security Policies and Procedures
  • Analysis of Security Policies and Procedures
Security Auditing and Its Role in Security Testing
  • Purpose of a Security Audit
  • Risk Identification, Assessment, and Mitigation
  • People, Process and Technology
 
Security Testing Purposes, Goals and Strategies 
Introduction
The Purpose of Security Testing
The Organizational Context
Security Testing Objectives
  • The Alignment of Security Testing Goals
  • Identification of Security Test Objectives
  • The Difference Between Information Assurance and Security Testing
The Scope and Coverage of Security Testing Objectives
Security Testing Approaches
  • Analysis of Security Test Approaches
  • Analysis of Failures in Security Test Approaches
  • Stakeholder Identification
Improving the Security Testing Practices
 
Security Testing Processes
Security Test Process Definition
  • ISTQB Security Testing Process
  • Aligning the Security Testing Process to a Particular Application Lifecycle Model
Security Test Planning
  • Security Test Planning Objectives
  • Key Security Test Plan Elements
Security Test Design
  • Security Test Design
  • Security Test Design Based on Policies and Procedures
Security Test Execution
  • Key Elements and Characteristics of an Effective Security Test Environment
  • The Importance Of Planning and Approvals in Security Testing
Security Test Evaluation
Security Test Maintenance
 
Security Testing Throughout the Software Lifecycle
The Role of Security Testing in a Software Lifecycle
  • The Lifecycle View of Security Testing
  • Security-Related Activities in the Software Lifecycle
The Role of Security Testing in Requirements
The Role of Security Testing in Design
The Role of Security Testing in Implementation Activities
  • Security Testing During Component Testing
  • Security Test Design at the Component Level
  • Analysis of Security Tests at the Component Level
  • Security Testing During Component Integration Testing
  • Security Test Design at the Component Integration Level
The Role of Security Testing in System and Acceptance Test Activities
  • The Role of Security Testing in System Testing
  • The Role of Security Testing in Acceptance Testing
The Role of Security Testing in Maintenance
 
Testing Security Mechanisms 
System Hardening
  • Understanding System Hardening
  • Testing the Effectiveness of System Hardening Mechanisms
Authentication and Authorization
  • The Relationship Between Authentication and Authorization
  • Testing the Effectiveness of Authentication and Authorization Mechanisms
Encryption
  • Understanding Encryption
  • Testing the Effectiveness of Common Encryption Mechanisms
Firewalls and Network Zones
  • Understanding Firewalls
  • Testing Firewall Effectiveness
Intrusion Detection
  • Understanding Intrusion Detection Tools
  • Testing the Effectiveness of Intrusion Detection Tools
Malware Scanning
  • Understanding Malware Scanning Tools
  • Testing the Effectiveness of Malware Scanning Tools
Data Obfuscation
  • Understanding Data Obfuscation
  • Testing the Effectiveness of Data Obfuscation Approaches
Training
  • The Importance of Security Training
  • How to Test the Effectiveness of Security Training
 
Human Factors in Security Testing
Understanding the Attackers
  • The Impact of Human Behavior on Security Risks
  • Understanding the Attacker Mentality
  • Common Motivations and Sources of Computer System Attacks
  • Understanding Attack Scenarios and Motivations
Social Engineering
Security Awareness
  • The Importance Of Security Awareness
  • Increasing Security Awareness
 
Security Test Evaluation and Reporting
Security Test Evaluation
Security Test Reporting
  • Confidentiality of Security Test Results
  • Creating Proper Controls and Data Gathering Mechanisms for Reporting Security Test Status
  • Analyzing Interim Security Test Status Reports
 
Security Testing Tools
Types and Purposes of Security Testing Tools
Tool Selection
  • Analyzing and Documenting Security Testing Needs
  • Issues with Open Source Tools
  • Evaluating a Tool Vendor’s Capabilities
 
Standards and Industry Trends
Understanding Security Testing Standards
  • The Benefits of Using Security Testing Standards
  • Applicability of Standards in Regulatory Versus Contractual Situations
  • Selection of Security Standards
Applying Security Standards
Industry Trends
  • Where to Learn of Industry Trends in Information Security
  • Evaluating Security Testing Practices for Improvements
 
Class Daily Schedule
Sign-In/Registration 7:30 - 8:30 a.m.
Morning Session 8:30 a.m. - 12:00 p.m.
Lunch 12:00 - 1:00 p.m.
Afternoon Session 1:00 - 5:00 p.m.
Times represent the typical daily schedule. Please confirm your schedule at registration.
Training Course Fee Includes
• Tuition
• Course notebook
• Letter of completion