I'm preparing for the CCSP examine and am trying to wrap my mind around the concepts of "load testing" and "stress testing" within the context of security.

I think the difference here is that:

  • Load Testing is a measure of capacity, pure and simple. It focuses on the "A" (availability) and isn't concerned about the security implications of a failed state.

  • Stress Testing is focused on how the system system behaves after reaching a point of load saturation. For example, does the software/service fail in spectacular ways? Does it reveal sensitive errors (software versions, back-end infrastructure details, etc)?

Am I on the right track here?


There's a few different definitions, however the one I go with is that Load Testing is taking an application up to its expected maximum load level to make sure it performs. Stress testing is deliberately taking an application past its normal parameters to see how it tolerates a greater than expected load. It's sometimes called torture testing, seeing how an application breaks.

From a security perspective you should always care about the security implications. No matter how much load an application is exposed to it should always follow its security parameters, or if it is going to fail, fail safe.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.