Currently I am working on a project in which I am supposed to define the following aspects as a test manager:
- Conception of a penetration test for a test staging environment
- Planning security guidelines for REST API development
- Use of REST API scans via SOAPUI (create security test cases)
So my planning within the staging environment includes functional test procedures, integration test, as well as test procedures on the RESTAPI level. I am however undecided whether the pure security test about the SOAPUI solution alone is enough to get a high security coverage.
Therefore I plan another possibility in the test environment with even more special tools which besides the RestAPI level also : Integration of W3af or Vooki into the staging environment.
Questions: Is a security test drive via SOAPUI sufficient ? Should I use a different tool in the Stage (Pre Production) and in the Production? Should I test Security Test with another tool within the staging environment?