I85PREP
⌘ K
ISTQB CT-SEC study materials
ISTQB CT-SEC study resources

ISTQB CT-SEC: Security Testing Tools and Standards

ISTQB CT-SEC · Work through your exam, one topic at a time.

All guide sections

Security Testing Tools and Standards

Security Testing Tools and Standards

The exam checks that you know what each tool family can and cannot do, and how standards turn vague security expectations into testable, reportable criteria.

Core rules

  • Tool families: SAST analyses source or bytecode without executing it (early, white-box, prone to false positives); DAST probes a running application (black-box, runtime, cannot see code paths); IAST uses runtime instrumentation; SCA inventories dependencies against known-vulnerability databases; fuzzers feed malformed input to find crashes and input-handling defects; interception proxies, network scanners and log/SIEM analysis support manual work.
  • Selection criteria: coverage, accuracy, CI/CD integration, currency of signature and rule updates, licensing cost, and the sensitivity of the code being scanned.
  • Tools support skilled testers; they miss business-logic flaws and multi-step exploit chains, and their output needs triage.
  • Standards to know: OWASP Top 10 (awareness categories, not a methodology), OWASP ASVS (verifiable requirements with levels), OWASP Testing Guide, CWE (weakness taxonomy), CVSS (scoring), NIST SP 800-115 (technical security testing process), ISO/IEC 27001 and 27002 (ISMS), ISO/IEC 15408 Common Criteria (assurance evaluation), ISO/IEC 29119 (test process), PCI DSS and GDPR (obligations).

Worked example

A payment team must demonstrate due diligence. PCI DSS supplies the obligations, OWASP ASVS Level 2 supplies verifiable requirements, SAST runs on every commit, DAST weekly, and an external penetration test follows NIST SP 800-115 annually. Findings are reported with CWE identifiers and CVSS scores. The reasoning: standards give traceability from obligation to test, and layered tools cover code, runtime and dependencies.

Traps

Assuming compliance equals security; offering a scanner report as the only evidence; trusting an out-of-date signature database; confusing a CVSS base score with business risk; treating the OWASP Top 10 as a complete test standard.