Re: Security Testing

It depends. Normally this kind of checking is given to a separate team to verify. In our organization, our developers normally write the programs, and a separate web application security team verifies the security of the application with pre-defined security requirements. Developer doing a security testing may not yield actual test results.

• Original Message ----- From: "Ramirez, Manuel N (CORP, DDEMESIS)" <Manuel.Ramirez@ddemesis.ge.com> To: <webappsec@securityfocus.com> Sent: Tuesday, March 04, 2003 2:09 AM Subject: Security Testing

Hi everybody,
I was wondering if some of you have some papers regarding web applications security testing. I'm working on a CMM iniciative and we are planning to include a security testing phase so every new developed application is security-error free.

Would you recommend every development team to perform security testing or it's better to have a group of experienced people doing these activities for all of the developed applications?

Best regards,
Manuel Received on Tue Mar 4 03:36:48 2003