Application Security and Penetration Testing

This chapter focuses on the importance of application security and penetration testing. Application testing is an important part of IT security. Application security testing is the process of using software, hardware, and procedural methods to prevent security flaws in applications and protect them from exploit. As a CASP+, you are not expected to be an expert programmer or understand the inner workings of a C++ program. What the CASP+ must understand, however, is the importance of application security, how to work with programmers during the development of code, and the role of testing code for proper security controls. Security by design means that the security measures are built-in and that security code reviews must be carried out to uncover potential security problems during the early stages of the development process. The longer the delay in this process will result the greater the cost to fix the problem. Cross-site scripting (XSS) attacks are an application issue that is caused by an injection problem. XSS occurs when malicious scripts are injected into otherwise trusted websites.