The OWASP Testing Framework

Before any testing is done, an organization must create a testing framework that consists of "techniques and tasks that are appropriate at various phases of the SDLC" (44).  The activities in the framework should happen:

•  before development begins
• In this stage, it is important to have a solid SDLC already developed.  With a strong SDLC, one must also have the right policies, standards, requirements and documentation ready for the development team.  It is extremely important for the development to team know what exactly they are doing.

• during definition and design
• The requirements and documents that are made in the first stage must be logically tested to make sure they make sense.
• Once the design of a system is completed, it is important to create UML models for it. Models just help everyone in the project to understand how the system works.
• Using the system model, try to create realistic threat models. In other words, if we find a weakness in the system model, we should create threat models that describe how an intruder can penetrate the system - then, try to make sure these weaknesses are patched.

• during development
• The first step in this stage is to perform a code walkthrough where the developers walkthrough the system's code to the security team. This allows the security team to understand what is going on in the code.
• After understanding what the code does, the security team should now review the code to find security flaws.

•  during deployment
• Deployment testing consists of penetration testing and making sure the system is  correctly configured correctly. Although the application could be safe, the system could have been installed improperly.

•  maintenance and operations
• Period health checks should be done on the system as new security flaws could be found with the age of the system.
• If the system needs any changes, make sure the change is well documented and thoroughly tested before implementation.