What does a security testing plan look like?
Can anyone point out a template for such a document or an example?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
There's also the Pentest Standard
There is a good resource on MSDN. Did you had a chance to read about this topic in MSDN Magazine?
Well, here you are the links that may help to define what you look:
NIST 800-53A and NIST 800-115 That's not strictly a test plan, but it is a catalog of the elements of a test plan. If you're working with a government system, that is a list of test standards for the security controls. If you're working on a commercial system, it is a catalog of resources.
Another resource for test plans is SANS Critical 20 Security Controls; personally I think that is legitimate but overhyped.
Abrams appears to be an example; you can find more by searching for Security Test & Evaluation Plans on Google.
Ultimately however, I think they all miss the mark. Modern security test plans should be done on the basis of risk. In my opinion, you should perform your risk assessment, identify the top N risks, and then develop a standard project plan to test/validate those risks within the resources available ($$, time, expertise, etc.).
Standards/policies, risk assessment and threat modeling should drive out a set of key risks and controls to mitigate them. What these consist of will depend on what is being delivered.
A test plan should fundamentally set out to evidence these controls. Penetration/vulnerability testing is only part of this. Other aspects could be code/build/configuration review, aspects of functional testing to ensure expected capabilities are present, 3rd party assurance and standards compliance.
Here is a request page for Test Plan Template for Websites and Web Applications provided by XBOSoft - http://www.xbosoft.com/contact/whitepaper/functional-test-plan-for-websites
This happens to be very pet question from security management perspective. For me it has happened in cases where I'm magically suppose to bring
'a PLAN' which solves all of the management worries. The plan by the definition demands focus and attention to specific details. A successful plan would ALWAYS matches its purpose , efforts and the results it delivers
Let me explain you further.
Firstly, a plan basically should work like a small project have all the ingredients of what should compromise as an effective and cost-effective project. Just like in any project you would discuss
Similarly, any plan for that matter should have a decent foot-print of an effective project management activities and planning.
Your statement would have made just the perfect contextual sense; if you added something like i want a testing plan for
xyz. XYZ here is arbitrary can be but not limited to:-
Secondly, a key point related to plans; is there a clean and distinct description of types of tests performed and the expected results. Usually these results are aligned or mapped with an already prepared METRICS to have an understanding on the level of success or failure achieved in performing these tests.
Lastly, you asked about stuff / things that goes in a PLAN. Saying if you have done your homework and know what goes where. You can start with the following outline.
Hope it helps you:)