| Application security functional testing involves testing the application for conformance to the application's security function specifications, as well as for conformance to the underlying security model. The need to verify security functionality applies to all security functions. The conformance criteria state the conditions necessary for the application to exhibit the desired security behavior or satisfy a security property, for example, successful login triggers an audit entry.
Organizations may define conditions requiring verification and the frequency in which such testing occurs. Security function testing usually occurs during the development phase and can, in some instances, occur in the production phase if the developer provides the security conformance criteria or if the conformance criteria can be established. There are application testing frameworks available that can perform functional testing on production systems however they are limited in their applicability and are language- or product-centric.
This requirement relates to functional testing of security specifications conducted during development. This is not done on a production application server. |
