Companies focusing more on the skillset (and mindset) needed for Security Testing

I am just back home after completing a training program at Novell Bangalore for about 3 days, on a series of diversified topics under Security Testing.

As usual, it was a challenging situation to address the varied needs of individual groups of attendees who joined from several different projects, however, I liked and enjoyed the three days for two reasons - I had an opportunity to package most of my experience and research in the field of Security Testing, and the attendees were very smart. I have been covering only Web Application Security Testing so far and the program at Novell had more focus on security testing even on desktop products and clients (It is under Non-disclosure so I can publish the course agenda here).

Having done about 15 programs on Security Testing in the last few months, I am happy to say that there is now a clear focus in companies on the skillset (and mindset) needed for Security Testing.

Exploratory Testing can be justified when you explore what not to do by hand

I was reading this post titled "Convince my boss to let me do exploratory testing", while most of what is said in it makes direct sense, I want to add a small point through this post.

Let us say, a tester has to test a text field with the below cases:

1. It has to be tested with multiple languages like English, Hebrew, Arabic, Kannada and Devanagiri.

2. It has an upper limit for its length, say 40 characters, and the tester wants to prepare strings with 40 characters and 41 characters (and also need to know, if a string gets truncated, where it got truncated).

Naturally the tester may ask for a lot of time to prepare the inputs that drive these tests.

It could be a tester who does everything manually, or a tech-savvy tester who want to develop scripts to accomplish the same, it takes time; and I consider that as "non testing time".

So, there is a desperate need for a tool that can aid the tester to do that.

Today, http://www.testersdesk.com/ has a toolkit named "Common Test Data Generators" which help them on that aspect. It is free for the entire testing community.

As you can see, we named it as "common" test data generators instead of hyping the simple things it does.

No, this post is not about TestersDesk.com, because it does a lot more than what is written here.

Exploratory Testing can be justified when you explore what not to do; i.e., the right ways of saving (or escaping from) some time needed in scripted testing.

And of course, the mixing proportions of testing time have to rightly balance scripted and exploratory testing, and there is no "this" or "that" type of testing, by itself, that can reveal all the defects.

Enjoying and respecting the fact that we are human beings,
Ashwin.

ends influence means - book becomes tool

A question that several people have asked me (like in this interview, for example), is

How and when did you get the idea of Testersdesk.

While I am not sure if I did the smart thing or not, wanted to write a post that externalizes my philosophy.

Most of us get a new idea, most of the time, with a particular set of "ends" we want to reach.

Couple of years ago, when I wanted to reach the "ends" of improved test productivity through smarter utilization of technology tools, I started writing a book on how to use technology in building utilities for Test Design, Test Data Generation, Test Diagnosis and Validation etc, primarily concentrating on things not broadly addressed by major test management and automated test execution tools. Said differently, the "end" I wanted to reach was inculcating toolsmith thinking in testers in their activities so that they can use their brain-work for more valid cases of value assurance.

Midway through the writing of the book, I found a clear need of translating all the work into a working product, as opposed to keeping it as some pages of text. I have convinced myself that a tool with "execution" power will reach the ends more quickly. Stopped writing the book, and basically became a spec for the tool, what it known as www.TestersDesk.com today.

So the point is the more faith we have in the ends, can influence the means we adopt. Some form of reverse as well as re-engineering.

Technically speaking, means can be viewed as several parallel threads racing to reach the end but I am not so fortunate to have the resources to run parallel threads!