Review By: Marsha L. Robertson
07/08/2010This book is based on and is an extension of Software Quality Engineering’s Web Security Testing course. It uses copious examples and checklists to teach this subject. The chapters stand well independently, so that they need not be read in a particular order to be understood or to be useful.

Chapters 1 and 2 are an introduction to the book and to test planning in general. Testing vocabulary and various testing approaches are also discussed. These chapters are a good beginning for testing novices and a good reference for others. Chapter 3 describes physical networks and gives options for testing possible configurations of a network, including determining the appropriate scope of tests. Chapter 4 does the same for system software, such as operating systems and communication tools.

Chapters 5 and 6 discuss testing options for client/server applications. These include making sure that good data is accepted and bad data is not, and that authorized users are allowed and unauthorized users are denied. Chapter 7 relates many sneaky ways (hence the title “Sneak Attacks”) that a Web system can be infiltrated, and how to test for these often overlooked areas of risk.

Chapter 8 is an explanation of some direct security methods and how to test them. General areas of discussion are detecting attempts at unauthorized access, confusing or distracting an intruder, and responses to an attack. Chapter 9 gives test implementation options, including how to choose who should test, what tools are used, and where testing should start and end. Chapter 10 discusses performing risk analysis and determining testing priorities.

The appendices are useful references on their own. Appendix A is a dictionary and overview of networking terms. Appendix B is a list of the twenty most critical Internet security vulnerabilities. Appendix C gives example templates for various test deliverables, such as status reports and testing logs. There is also an Additional Resources section that contains, among other things, a long list of other books related to Web security testing.

In his preface, the author states “Testing Web Security is an attempt to fill the need for a straightforward, easy-to-follow book that can be used by anyone who is new to the security-testing field.” I believe that he has done an admirable job of meeting his goal.

The chapters are well organized and provide plenty of examples. Terms are either defined as they are used, or they are defined in Appendix A. The checklists provided are a great starting point for test development.

This book will be useful for either brand-new testing organizations or for established test organizations where Web security testing is a new task. It should be on the reference shelf for anyone who has an interest in testing Web security.