I work in the InfoSec profession as an IT auditor. One of my duties at work is testing and verifying that necessary security requirements are in place before code and application updates are released to production environment. Our team in conjunction with QA function signs off on documentation indicating successful completion of testing. I am the team lead of my team.

One of our applications will be upgraded in production soon, and updates to be deployed are being tested. This application directly interfaces with credit card information of customers in addition to other sensitive customer data. Automated security testing have been completed already and results are OK. I wrote additional scenarios today, intending to manually test them later this week given the data sensitivity. However my manager told me that he does not feel additional testing is necessary due to coverage and the business need to deploy to production timely. I anticipate completion of manual test to take at most 2 - 3 days.

Automated testing excels in detecting commonly known vulnerabilities such as SQL injection, but are often insufficient to detect more complex issues or flaws in business logic of application. Without additional manual testing, at least of what I feel would be high-impact vulnerabilities, I am not comfortable in signing off on security requirements testing results.

How do I make a business case to convince my manager of additional testing?

  • 1
    Is there a subset of the security testing that you can do in 1 day? Could you continue testing even after the application is deployed? If your manager still doesn't see to think any additional testing is needed, s/he should sign off on the security testing not you. – jcmack Oct 8 '18 at 23:38
  • @solarflare - I removed some of the technical jargon (e.g: builds, controls, Nessus etc.). Please do edit further if still confusing. Thanks! – Anthony Oct 9 '18 at 0:12
  • @JoeStrazzere - testing of security controls is done interactively with QA function. Both teams have input into quantity / quality of testing. We focus more on nonfunctional requirements and QA on the functional requirements (behavior) – Anthony Oct 9 '18 at 0:48
  • @Anthony Who's signing off on the tests? Presumably that's your manager if he's saying no additional testing is required? If so you should maybe ask about how to make sure your manager has the full picture before he makes a decision. Are you worried he doesn't? Or could it be that this is more about your perfectionism than anything else? – Lilienthal Oct 9 '18 at 12:43

This is an update to an existing application. Do you think the update is at least as secure as the previous version? In that case users will have a less secure version while you are doing more tests. You can also continue testing after release. Check with the manager what happens if you find problems after release. Having a bug fix release after a major release is not unusual.

If you are in the EU, remind your boss that breaches can nowadays be very expensive. British Airways may get a £300 million fine.

  • +1 As a security auditor your job is primarily pointing out the risks and costs, over email. – rath Oct 9 '18 at 10:28

my manager told me that he does not feel additional testing is necessary due to coverage and the business need to deploy to production timely.

How do I make a business case to convince my manager of additional testing?

As with any other activity, you talk to your manager and point out the risks, the time, and the cost involved.

You talk about what could happen if the system is insufficiently tested. In particular, you emphasize what has happened in the past in your company.

You talk about the time required now to complete sufficient testing. And you talk about the additional time it would take if you need to remediate the problems after going to production.

You talk about the cost involved in testing now versus the potential cost should the system prove to be insufficiently tested

Then you listen.

You should decide ahead of time how you plan to react if your boss still insists that additional testing is not needed. Perhaps you can come to a compromise and perform additional testing after the current version has gone to production.

Deciding not to "sign off" when your boss says that you must seldom ends well.

In the future, try to get all testing (automated and manual) accepted as part of the formal project plan before the project begins.

Not the answer you're looking for? Browse other questions tagged or ask your own question.