01 What is Security Testing?
The CIA Triad as a testing frame, and the scope boundary between a QA engineer identifying and reporting security risk versus a penetration tester exploiting it.
02 Threat Modeling, Risk Assessment, and Abuse Cases
Mapping a feature's attack surface, threat modeling at a tester's level, and abuse/misuse cases as a concrete test-design technique that generates security test cases before code exists.
03 Secure SDLC and Security Requirements
Shift-left security testing, writing testable security requirements instead of vague security goals, and security test planning as a concrete deliverable produced before code exists.
04 OWASP Top 10 for Testers
The general OWASP Top 10 as an orientation map for application security testing, explicitly distinguished from the OWASP API Security Top 10 this path's own Module 16 cross-links rather than duplicates.
05 Authentication Testing
Testing password policies, multi-factor authentication, account lockout behavior, and credential handling as their own distinct, testable surface.
06 Session Management, Cookies, and JWT
Testing session fixation and hijacking, cookie security flags, and JWT validation from a tester's vantage point once a login has already succeeded.
07 Authorization and Access Control Testing
Testing role-based access, privilege boundaries, and data isolation at the application layer, distinguishing horizontal from vertical privilege escalation and extending Database Security Testing's data-layer access-control discipline.
08 Input Validation and Output Encoding
QA-level recognition of injection- and XSS-class symptoms using harmless, legitimate-looking proof input, distinguishing input validation from output encoding as two separate, both-necessary defenses.
09 Security Test Planning and Test Case Design
Extending Writing Clear Test Cases into a security-specific test case with explicit traceability back to the security requirement it verifies, replacing tribal-knowledge security testing with a written, provable artifact.
10 Static vs. Dynamic Security Testing
SAST and DAST as concepts, taught concept-first and tool-neutral — what each catches, what each structurally misses, and why a mature security-testing practice needs both.
11 Vulnerability Validation and Security Regression Testing
Triaging a scanner or bug-bounty finding as real versus noise using legitimate reproduction, then verifying a fixed security defect doesn't quietly return in a later release.
12 Configuration, Secrets, and Transport Security
Testing whether the environment itself is hardened — security headers, rate limiting, and secrets accidentally left in configuration files — distinct from feature-level testing.
13 Business Logic Security Testing
Testing workflow-step bypass, race conditions, and price manipulation — a class of security defect with no technical vulnerability underneath it, found through test design rather than a scanner.
14 Data Protection, PII, and Compliance Awareness
Testing for over-exposure of personally identifiable information and verifying data-deletion requests are actually honored, from a QA awareness level rather than legal expertise.
15 Logging, Audit Trails, and Security Observability
Testing that security-relevant events are actually logged with attributable detail, and that audit logs themselves resist tampering by the very users whose actions they record.
16 Security Testing Across API, Database, Mobile, AI, and Cloud
How this path's own CIA Triad, access-control, and identification-scope principles are the same discipline underneath API, Database, Mobile, and AI for QA's own security modules, plus tester-level cloud security awareness as a genuinely new surface.
17 Security Automation and Security in CI/CD
Making security regression tests and dependency scanning real, blocking gates in the delivery pipeline, extending CI/CD Integration's own real-gate-versus-optional-step principle to security specifically.
18 Security Reporting, Bug Reporting, and Risk Communication
Extending Writing Effective Bug Reports into a security-specific, dual-audience format: a technical report for engineering and a plain-language risk summary for non-technical stakeholders.
19 Applying Security Testing: AtlasBank Validation
Combining threat modeling, access control, business logic, data protection, and logging technique from Sections 1-5 against a realistic, integrated AtlasBank Add a Payee feature.
20 Applying Security Testing: AtlasShop Validation
Combining access control, cloud storage, and configuration technique from Sections 1-5 against a realistic, integrated AtlasShop seller dashboard feature, contrasting with AtlasBank's payee-management findings.
21 Common Mistakes in Security Testing
Six security-testing mistake patterns spanning scope, verification, timing, coverage assumptions, process integration, and communication — each traced back to a real defect earlier in this path.
22 Capstone: AtlasBank International Transfer Under Security Scrutiny
The complete security-testing lifecycle applied to AtlasBank's International Money Transfer feature — a seventh layer of verification confirming business-logic bypass resistance and finding a genuine audit-trail integrity gap no prior certified layer tested for.
Section 1 — Review
Knowledge Check for Section 1 — What is Security Testing?, Threat Modeling/Risk Assessment/Abuse Cases, and Secure SDLC and Security Requirements.
Section 1 — Solutions
Answers and reasoning for Section 1's Knowledge Check — applying the CIA Triad, the security-testing scope boundary, threat modeling, and testable security requirements to five realistic scenarios.
Section 2 — Review
Knowledge Check for Section 2 — OWASP Top 10 for Testers, Authentication Testing, Session Management/Cookies/JWT, and Authorization and Access Control Testing.
Section 2 — Solutions
Answers and reasoning for Section 2's Knowledge Check — applying OWASP categorization, authentication, session management, and access-control testing to five realistic scenarios.
Section 3 — Review
Knowledge Check for Section 3 — Input Validation and Output Encoding, Security Test Planning and Test Case Design, Static vs. Dynamic Security Testing, and Vulnerability Validation and Security Regression Testing.
Section 3 — Solutions
Answers and reasoning for Section 3's Knowledge Check — applying input/output testing, traceable test-case design, SAST/DAST, and vulnerability validation to five realistic scenarios.
Section 4 — Review
Knowledge Check for Section 4 — Configuration/Secrets/Transport Security, Business Logic Security Testing, Data Protection/PII/Compliance Awareness, and Logging/Audit Trails/Security Observability.
Section 4 — Solutions
Answers and reasoning for Section 4's Knowledge Check — applying environment-level, business logic, data protection, and logging testing to five realistic scenarios.
Section 5 — Review
Knowledge Check for Section 5 — Security Testing Across API/Database/Mobile/AI/Cloud, Security Automation and CI/CD, and Security Reporting/Bug Reporting/Risk Communication.
Section 5 — Solutions
Answers and reasoning for Section 5's Knowledge Check — applying cross-domain security discipline, CI/CD gating, and dual-audience reporting to five realistic scenarios.