Security Test Planning

When to Use This Skill

Use this skill when:

• Security Test Planning tasks - Planning security testing strategies for applications
• Planning or design - Need guidance on OWASP testing, pen test scoping, SAST/DAST
• Best practices - Want to follow established security testing standards

Overview

Security testing validates that applications are protected against threats and vulnerabilities. A comprehensive security test strategy combines automated scanning, manual testing, and threat-based test case design.

---

Security Testing Pyramid

                    ┌───────────┐
                   /  Pentest    \         Manual, Expert
                  /   Red Team    \        (Quarterly)
                 /─────────────────\
                /      DAST          \     Dynamic Scanning
               /    (Runtime)         \    (Weekly/Release)
              /───────────────────────\
             /         SAST             \  Static Analysis
            /      (Build Time)          \ (Every Commit)
           /─────────────────────────────\
          /      Secret Scanning           \ Pre-Commit
         /     Dependency Scanning          \ (Continuous)
        └───────────────────────────────────┘

---

Quick Reference: Testing Layers

Layer	Tools	Frequency	Gate
Layer 1 (CI/CD)	Gitleaks, SonarQube, Snyk, Trivy	Every commit	Block Critical
Layer 2 (Periodic)	OWASP ZAP, Burp, 42Crunch	Weekly/Release	Block High+
Layer 3 (Manual)	Penetration testing, Code review	Quarterly	Block All

---

OWASP Top 10 Quick Coverage

Category	Testing Approach
A01: Broken Access Control	Manual + Automated
A02: Cryptographic Failures	Code review + SAST
A03: Injection	SAST + DAST + Manual
A04: Insecure Design	Threat modeling
A05: Security Misconfiguration	Config scanning
A06: Vulnerable Components	SCA
A07: Auth Failures	Manual + Automated
A08: Data Integrity	Manual testing
A09: Logging Failures	Log review
A10: SSRF	DAST + Manual

---

Remediation SLAs

Severity	SLA	Verification
Critical	24 hours	Immediate retest
High	7 days	Next sprint retest
Medium	30 days	Quarterly scan
Low	90 days	Annual review

---

References

Reference	Content	When to Load
security-strategy-template.md	Full strategy template, scope, compliance, metrics	Planning security test strategy
owasp-testing.md	WSTG test categories, test case template	Writing OWASP-aligned test cases
dotnet-security-tests.md	Auth, input validation, rate limiting tests	Implementing .NET security tests
sast-dast-integration.md	CI/CD gates, ZAP integration, tool comparison	Setting up automated security scanning

---

Integration Points

Inputs from:

• Threat model → Test priorities
• Security requirements → Coverage targets
• test-strategy-planning skill → Overall strategy

Outputs to:

• CI/CD pipeline → Security gates
• devsecops-practices skill (security plugin) → Remediation
• Compliance reporting → Evidence

---

Test Scenarios

Scenario 1: Planning security test strategy

Query: "Help me create a security test plan for our web application"

Expected: Skill activates, provides strategy template, guides through scope and layers

Scenario 2: OWASP-aligned testing

Query: "What OWASP tests should I run for authentication?"

Expected: Skill activates, loads owasp-testing.md reference, provides WSTG-ATHN tests

Scenario 3: .NET security tests

Query: "Show me how to test for SQL injection in .NET"

Expected: Skill activates, loads dotnet-security-tests.md reference, provides code examples

---

Last Updated: 2025-12-28

Version History

• v1.1.0 (2025-12-28): Refactored to progressive disclosure - extracted tests/templates to references/
• v1.0.0 (2025-12-26): Initial release