# Testing Ask Me Anything – Security Testing with Saskia Coplans **URL:** \ **Category:** 🗓️ Events\ **Tags:** ask-me-anything, security, career-development\ **Created:** [2 November 2021 15:02 UTC](https://club.ministryoftesting.com/t/testing-ask-me-anything-security-testing-with-saskia-coplans/54578 "2021-11-02T15:02:52Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![simon\_tomes](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/simon_tomes/32/14009_2.png) [@simon\_tomes](https://club.ministryoftesting.com/u/simon_tomes)\ **Post date:** [2 November 2021 15:02 UTC](https://club.ministryoftesting.com/t/testing-ask-me-anything-security-testing-with-saskia-coplans/54578/1 "2021-11-02T15:02:52Z")
Later today @testerfromleic hosts an [Ask Me Anything](https://www.ministryoftesting.com/events/testing-ask-me-anything-security-testing-with-saskia-coplans) with the excellent @saskia on Security Testing. They’ll be a brilliant set of questions and typically we won’t get time for them to be answered. However, we’ll add any questions we didn’t get to on this thread for Saskia to answer. Plus I’ll share links to all the things shared. :ninja_red: :ninja_blue: :ninja_purple: And feel free to continue the conversation, this thread is a good place to do that. Share resources and follow up with success stories from your learnings! 🏆 A recording of the Ask Me Anything will be made available. Look out for it on [the Ask Me Anything Page](https://www.ministryoftesting.com/dojo/series/testing-ask-me-anything) in the coming days. 🎥 ---
**Author:** ![simon\_tomes](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/simon_tomes/32/14009_2.png) [@simon\_tomes](https://club.ministryoftesting.com/u/simon_tomes)\ **Post date:** [2 November 2021 21:06 UTC](https://club.ministryoftesting.com/t/testing-ask-me-anything-security-testing-with-saskia-coplans/54578/2 "2021-11-02T21:06:31Z")
### Questions that were answered - How do I get started with Security Testing as in (a) learning resources, (b) easy things to start testing for, and (c) understanding the bigger picture of security? - Would you mind sharing how the OWASP Top Ten helps you when planning your security testing efforts? - How do you convince leadership/management to take security risks seriously when they are prioritising other risks? - For someone with no specific knowledge of security testing, what would be the top 3 things to test in the early stages? - Are the open source tools as good as the commercial tools and how often should the scan be run? Probably build it into the CI/CD pipeline? - Security has a lot of different things to test/verify. In your opinion, is it better for the whole team to know how to check a few things, or to have a few people dedicated to thorough security testing? - Whilst there are things that only a dedicated security tester can do, like pen testing, what low hanging fruit could us non-security testers do to help? - What’s the biggest security testing horror story you are comfortable sharing? - This may naturally come up, but how did you get into security testing? Did you do other testing and migrate over? Do other security and move to more testing? Something else? ### Useful links shared [https://www.rexscan.com/](https://www.rexscan.com/) > **[OWASP Foundation, the Open Source Foundation for Application Security | OWASP...](https://owasp.org/)** > > OWASP Foundation, the Open Source Foundation for Application Security on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software. > **[OWASP Top Ten | OWASP Foundation](https://owasp.org/www-project-top-ten/)** > > The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code. [https://owasp.org/www-project-zap/](https://owasp.org/www-project-zap/) > **[OWASP Juice Shop | OWASP Foundation](https://owasp.org/www-project-juice-shop/)** > > Probably the most modern and sophisticated insecure web application for security trainings, awareness demos and CTFs. Also great voluntary guinea pig for your security tools and DevSecOps pipelines! > **[Cyber Mastery: Community Inspired. Enterprise Trusted.](https://www.hackthebox.com/)** > > We raise your cyber resilience by transforming technical teams into a mission-ready workforce, so every organization can stay ahead of tomorrow’s threats. Get started now with personal or team plans. > **[OWASP Mobile Top 10 | OWASP Foundation](https://owasp.org/www-project-mobile-top-10/)** > > OWASP Mobile Top 10 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software. > **[Events | The OWASP Foundation Inc.](https://owasp.glueup.com)** > > Discover and register for all the events hosted by OWASP Foundation Inc. [https://twitter.com/TheTestDoctor](https://twitter.com/TheTestDoctor) > **[Manchester Grey Hats](https://manchestergreyhats.co.uk/)** > **[Threat Modeling - OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html#draw-attack-vectors-and-attacks-tree)** > > Website with the collection of all the cheat sheets of the project. > **[MITRE ATT&CK®](https://attack.mitre.org/)** > **[Threat Modelling: How Software Survives in a Hacker’s Universe Saskia Coplans](https://www.ministryoftesting.com/testbash-sessions/threat-modelling-how-software-survives-in-a-hacker-s-universe-saskia-coplans)** > > Watch "TThreat Modelling: How Software Survives in a Hacker’s Universe" with Saskia Coplans from TestBash Manchester 2019 > **[Unmasking Security: Seeing Through the Eyes of an Attacker - Saskia Coplans](https://www.ministryoftesting.com/testbash-sessions/unmasking-security-seeing-through-the-eyes-of-an-attacker-saskia-coplans)** > > Watch Saskia Coplan's talk "Unmasking Security: Seeing Through the Eyes of an Attacker" from TestBash Netherlands 2020 [https://www.microsoft.com/security/blog/2007/09/11/stride-chart/](https://www.microsoft.com/security/blog/2007/09/11/stride-chart/) [https://twitter.com/adamshostack](https://twitter.com/adamshostack) What is Thread Modelling? [Shostack + Associates \> The Ultimate Beginner's Guide to Threat Modeling](https://shostack.org/resources/threat-modeling) [Elevation of Privilege (EoP) Threat Modeling Card Game – Agile Stationery](https://agilestationery.com/products/elevation-of-privilege-game#:~:text=The%20Elevation%20of%20Privilege%20card,introduced%20by%20Kornfelder%20and%20Garg). [https://play.google.com/store/apps/details?id=com.eop&hl=en&gl=US](https://play.google.com/store/apps/details?id=com.eop&hl=en&gl=US) > **[The ZAP Homepage](https://www.zaproxy.org/)** > > Welcome to ZAP! Simon Bennetts [https://twitter.com/psiinon](https://twitter.com/psiinon) Context Driven Security - Bill Matthews [Context Driven Security - Bill Matthews | Ministry of Testing](https://www.ministryoftesting.com/dojo/lessons/context-driven-security-bill-matthews?s_id=12259644) > **[Useful online security tips and articles | F‑Secure](https://www.f-secure.com/en/articles)** > > True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further. The Wheels on the Bus Go Fail, Fail, Fail - Yong Yuen He and Daniel Smart > **[The Wheels on the Bus Go Fail, Fail, Fail - Yong Yuen He and Daniel Smart](https://www.ministryoftesting.com/testbash-sessions/the-wheels-on-the-bus-go-fail-fail-fail-yong-yuen-he-and-daniel-smart)** > > Watch "The Wheels on the Bus Go Fail, Fail, Fail" with Yong Yuen He and Daniel Smart from TestBash Manchester 2019 [https://twitter.com/ms\_\_chief](https://twitter.com/ms__chief) Digital Interruption [https://www.digitalinterruption.com/](https://www.digitalinterruption.com/) Giggle; laughable security [Giggle; laughable security | Digital Interruption Research](https://research.digitalinterruption.com/2020/09/10/giggle-laughable-security/) > **[HackerOne | Global leader in offensive security | Security for AI |...](https://www.hackerone.com/)** > > HackerOne combines AI with the ingenuity of the largest community of security researchers to find and fix security, privacy, and AI vulnerabilities across the SDLC. HackerOne offers AI red teaming, crowdsourced security, bug bounty, vulnerability... > **[\#1 Crowdsourced Cybersecurity Platform | Bugcrowd](https://www.bugcrowd.com/)** > > Bugcrowd teams with elite security researchers to reduce risk & improve security ROI through our bug bounty, pen testing, & vulnerability disclosure programs. Jay Harris on Twitter [https://twitter.com/JayHarris\_Sec](https://twitter.com/JayHarris_Sec) ### Questions to be answered that weren’t answered during the AMA - Do automation testers need security testing skills? ---
**Author:** ![kristof](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/kristof/32/10839_2.png) [@kristof](https://club.ministryoftesting.com/u/kristof)\ **Post date:** [4 November 2021 13:34 UTC](https://club.ministryoftesting.com/t/testing-ask-me-anything-security-testing-with-saskia-coplans/54578/3 "2021-11-04T13:34:45Z")
A nice addon is also the OWASP TOP 10 API SECURITY, since we do a lot of API testing, it could be useful! - [OWASP API Security - Top 10 | OWASP](https://owasp.org/www-project-api-security/)