Re: Security Testing

["planz" <planz235 () hotmail com>]

It depends.  Normally this kind of checking is given to a separate team to verify.  In our organization, our developers 
normally write the programs, and a separate web application security team verifies the security of the application with 
pre-defined security requirements.  Developer doing a security testing may not yield actual test results.


----- Original Message ----- 
From: "Ramirez, Manuel N (CORP, DDEMESIS)" <Manuel.Ramirez () ddemesis ge com>
To: <webappsec () securityfocus com>
Sent: Tuesday, March 04, 2003 2:09 AM
Subject: Security Testing



Hi everybody,
I was wondering if some of you have some papers regarding web applications security testing. I'm working on a CMM 
iniciative and we are planning to include a security testing phase so every new developed application is security-error 
free. 

Would you recommend every development team to perform security testing or it's better to have a group of experienced 
people doing these activities for all of the developed applications?

Best regards,
Manuel