Review By: Karen Johnson
07/09/2010This is a tester’s book. Pure testing—no theories or academic philosophies. This book is designed for testers whose hands are on the keyboard and who are hungry for testing ideas. The book is geared to client-server or Web testing in the Windows environment. Some concepts may be applicable to other environments.

The book is laid out in a series of testing tactics presented as attacks that can be launched against an application. The attacks range from clever (diminished network connectivity versus complete outages) to classic (boundary conditions) to offbeat (recursive functions).

The book offers a companion CD with a tool called canned HEAT. The tool provides a ready means of simulating attacks by selecting conditions and being able to use the tool with your own software under test. What’s disappointing is that HEAT only works with Win2000.

A series of appendices round out the shorter book very well. A couple of appendices are devoted to explaining HEAT and another tool included on the CD. The glossary is lean. Another appendix is an article reprint entitled "What Is Software Testing? And Why Is It so Hard?" It’s a good question and an interesting in-depth discussion.

This book is written for the intermediate tester. Novice testers might not appreciate the tactics or understand the depth of the attacks presented. At times, there is a fair amount of assumed knowledge, such as discussions of API calls, with little introduction or clarification. Advanced testers may struggle to glean new tips from the book. But an intermediate hands-on tester will be able to follow along technically and likely find themselves smiling with new ideas to apply immediately at work.

The summary sections are well written and for a testing manager, they may be all that is necessary to read. Review the attack headings to tap into the concepts presented and decide what is applicable.

The book is laid out in a series of testing tactics presented as attacks that can be launched against an application. The attacks are laid out in a consistent pattern of what, when, and how. I would have liked a "why" section added to each attack that could give a clear purpose of the end goal of the attack. And the "why" sections could offer insight into the risk and the likelihood of the attack.

On one hand, using the premise of attacks works well since testers often perform best when a sense of competitiveness is in the air. On the other hand, a less experienced tester may focus on the negative aspect of attacking someone else’s work. The book would do well to remind testers that when they are ready to discuss bugs with a developer, in most companies and with most developers, it's best for testers to keep their bug-hunting glee to themselves and stick to the facts.

The list of attacks creates a terrific reference book. Suppose a handful of the attacks don't apply to the software you are testing at your present job. After a change of jobs or change of projects, some material may now perfectly suit your needs. This will be a testing book to return to.