ISTQB CT-SEC case studies
ISTQB CT-SEC · Put your knowledge to work in context.
The ISTQB® Certified Tester Security Tester (CT-SEC) is a Specialist-level qualification in the ISTQB® portfolio. Per the official ISTQB® site, the certification "focuses on planning, performing, and evaluating security tests from multiple perspectives including risk, requirements, vulnerability, and human factors," and "also covers security testing tools and standards." It sits alongside other specialist certifications such as CT-STE, CT-MAT and CT-PT, and the site describes the security test engineer release as "an important extension within ISTQB's portfolio," tracing the first security testing syllabus back to 2016. The ISTQB CT-SEC case studies are 5 cases and about 4,273 words.
1Scoping a Risk-Based Security Test Plan for a PCI Payment Portal
Meridian Assurance runs an online premium payment portal for 40,000 policyholders. Card payments are handled by a third-party iframe (SAQ A-EP scope), and a new REST API lets 120 broker partners submit quotes.
853 words, about 4 min2Authenticated Scanning and Access-Control Testing for a Retail API
Vantage Retail's storefront exposes about 1,200 REST endpoints behind an API gateway. Authentication uses OpenID Connect with 15-minute access tokens; admin accounts require MFA, customer accounts do not.
875 words, about 4 min3Evaluating Ambiguous Security Requirements and Human Factors in Telemedicine
CareNow runs a telemedicine platform used by 600 clinicians across 14 hospitals. The specification for release 8.2 contains two security requirements: 'All patient data must be encrypted' and 'The system must be secure.' The platform stores consultation notes and video recordings classed as special-category data under GDPR.
847 words, about 4 min4Triaging a Penetration Test Report Six Days Before Release
Northline Retail's release 12 is due in six days. The external penetration test delivered 14 findings, including these: (1) insecure deserialization in an internal admin batch service, CVSS 9.8, reachable only from a hardened jump host with MFA, with no route from the internet, and the testers could not demonstrate exploitation; (2) reflected XSS on a public store-locator page, CVSS 5.3, unauthenticated, with no cookies in scope on that page; (3) a scanner-reported SQL injection on the search page that the testers could not reproduce, where timing suggests the scanner measured a five-second server-side cache miss; (4) verbose stack traces returned in API error responses; (5) password-reset tokens placed in the URL query string and written to load-balancer access logs retained for 30 days.
890 words, about 4 min5Selecting Security Tools and Producing Audit Evidence Under Pipeline Constraints
Solvay Health Systems has 60 developers maintaining 40 repositories in Java, TypeScript and Python. The CI pipeline must finish within 12 minutes.
808 words, about 4 min