Summary

In this chapter, you have seen many examples of security processes and tests you should run on your application. The first step in security testing is identifying the attack area – what different kinds of servers do you have, which are public and private, what ports do they have open, and what protocols do they support? Armed with that information, you can perform security scans and design test plans on the relevant machines.

We described running security scans and code analyses as the first steps for testing security, and considered the main areas of security vulnerability, including logging in, privilege levels, and user and file inputs. We looked at web server misconfigurations that can lead to security problems and considered PII, which is particularly sensitive and needs to be identified throughout your system, along with a process to ensure its deletion.

Finally, we looked at systems around security testing of the application, including running a bug bounty...