Generally speaking, security testing is treated as an add-on to our testing coverage. Well, it is like this; if you want to function very well and you want your customers to love you for what you have given them? It becomes very important to care for their software needs. And people hate when their data is compromised. But, the fact remains the same. And that fact says, “No matter what your users want, you still continue only with functional testing and UX testing”, but you forgot that if users do not have secure experience then they shall still be satisfied with your User eXperience ingredients. However, this is a sloppy fact and a lie which many people consider as a fact.
Possible reasons why security testing is not given importance?
#1 Product owners/stakeholders are not aware of how security testing can help to safeguard their business in the long-run.
#2 Companies are doing great business and they are least bothered to spend on security testing activity
#3 Testers in testing companies do not have time to learn something else. Really?
#4 To do security testing, passion is required and most of us lack that.
#5 Most or some testers want straight-forward training with security/penetration testing tools, they do not want to practice the mindset of it. Mindset is always boring, we humans are impatient and we want have take-away very soon.
#6 Most or some testers do not like to spend on credible security testing workshops. They always love to receive but do not like to give (And here giving for the workshop will benefit themselves).
So what’s the solution?
Security testing is not an option, it’s a choice for those who want to build a cleaner and safer web. Those who perform security testing for their web apps or mobile apps or client-server stand-alone apps contribute to the world for the safe web. Others would continue to make money without caring for the data of users, that’s inevitable. You can do your bit if you like to. Having said that, some or most people may face a large loss due to breaches and also class-action lawsuits due to sloppy security practices in their organization. For instance, you don’t want to be fined for not being compliant towards GDPR (General Data Protection Regulation).
What can we do as testers to create awareness?
No worries if your area of interest is functional testing, but you can still learn something about security testing and help your customer understand the importance of it. But, its tricky as your customer may go to someone else who can do both functional testing and security testing. But, I personally would make the customer understand even though I cannot test for security. Like how a layman can be made understood about security hassles, even you can do it for a customer.
Why it’s a choice and not an option?
It is simple! You are dealing with sensitive data of your users. How can you consider it as an option? It’s surely a choice that you want to safeguard your users. Don’t you?
Santhosh Tuppad has played different roles in his life which include being an entrepreneur, liar, lover, boyfriend, husband, thief, passionate software tester, blogger, reader, trainer, coach, black-hat hacker, white-hat hacker, grey-hat hacker and what not. In this amazing journey of life, he has experienced his salvation. Not to forget that, “Salvation comes at a price” and of course he has paid that price. Before he was known for being merciless, ruthless, unkind, evil etc. And today he is known for kindness, humbleness, and some people call him “Privacy Fighter”.
The last day or “The Conference Day” was well structured and entertaining too, offering the participants a wide variety of topics and keynotes to choose from. The main ones approached topics as: the importance of cybersecurity and ethical mindset in software testing, VR concepts, automation engineering, required leadership skills in an IT work environment and how to better train your mind in order to perform well in this field. The overall vibe of this day was fantastic, the audience was very interested in the topics debated, the conference rooms were occupied over their seat capacity and the speakers were very well prepared and eager to share their ideas with us, and also being very responsive to feedback and Q&A sessions, offering the audience bits of their day-to-day experiences and challenges as professional software testers. Each of them came up with a different perspective on software testing, using creative or technical approaches, highlighting the most important facts and clarifying all the misconceptions in order to further accelerate the continuous learning process and encourage the testers to bring more value to an organization by developing a new mindset. The discussions continued even after the keynotes, when participants and speakers shared their views and opinions during coffee & snack breaks, engaging in debates over the latest topics.
interests and passions and offering the opportunity to benefit from being part of a loving and supportive community that will help you grow personally and professionally. In the end, I would say that RTC is a wonderful experience that leaves you drained and full of energy at the same time, gives you tons of new ideas and fresh perspectives regarding the software testing field and motivates you to learn and experiment even more with what you have discovered. I encourage every curious-mind passionate about technology and quality to give it a try and take part in the largest testing conference in Central-Eastern Europe the next year. I am sure that you will enjoy it, meet lots of people that you can share your curiosities and ideas with and discover a lot of useful information that will change your overall perspective and understanding about this domain. After being part of RTC once you will certainly be eager to attend the next edition, as I am now.