<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: building-security-testing-methodology
subdomain: security-testing
title: "Building Security Testing Methodology"
tags:
  - methodology
  - testing-framework
  - OWASP
  - PTES
  - standardization
metadata:
  mitre-attack: ["T1190"]
---

# Building Security Testing Methodology

> Design and implement standardized security testing methodologies that ensure consistent, repeatable, and comprehensive security assessments.

## Overview

A security testing methodology provides a structured, repeatable framework for conducting security assessments. This technique covers methodology design, test case management, quality assurance, and reporting standards aligned with industry frameworks like OWASP, PTES, and OSSTMM.

## Core Concepts

- **Methodology phases**: Scoping, reconnaissance, testing, analysis, reporting
- **Test case library**: Reusable, categorized test cases with expected outcomes
- **Coverage tracking**: Ensure all relevant attack surfaces are tested
- **Quality gates**: Peer review and QA checkpoints throughout the assessment
- **Reporting standards**: Consistent finding format with severity, evidence, and remediation

## Workflow

1. Define methodology scope aligned with target assessment types
2. Map phases to industry frameworks (PTES, OWASP Testing Guide)
3. Build test case library organized by category and risk
4. Design coverage matrices for each target type
5. Establish quality gates and peer review checkpoints
6. Create reporting templates with standardized finding format
7. Define severity rating criteria with consistent scoring
8. Build knowledge base of common findings and remediations
9. Train testing team on methodology execution
10. Review and update methodology quarterly based on lessons learned

## Implementation

```python
from dataclasses import dataclass, field
from enum import Enum
from typing import Optional


class TestPhase(Enum):
    SCOPING = "scoping"
    RECONNAISSANCE = "reconnaissance"
    TESTING = "testing"
    ANALYSIS = "analysis"
    REPORTING = "reporting"


class TestStatus(Enum):
    NOT_STARTED = "not_started"
    IN_PROGRESS = "in_progress"
    COMPLETED = "completed"
    BLOCKED = "blocked"
    NOT_APPLICABLE = "not_applicable"


@dataclass
class TestCase:
    case_id: str
    title: str
    category: str
    phase: TestPhase
    description: str
    status: TestStatus = TestStatus.NOT_STARTED
    findings: list[str] = field(default_factory=list)
    reference: str = ""


class SecurityTestMethodology:
    """Standardized security testing methodology framework."""

    def __init__(self, name: str, version: str = "1.0") -> None:
        self.name = name
        self.version = version
        self.test_cases: list[TestCase] = []

    def add_test_case(self, case: TestCase) -> None:
        self.test_cases.append(case)

    def by_phase(self, phase: TestPhase) -> list[TestCase]:
        return [tc for tc in self.test_cases if tc.phase == phase]

    def coverage_report(self) -> dict:
        total = len(self.test_cases)
        completed = sum(1 for tc in self.test_cases if tc.status == TestStatus.COMPLETED)
        with_findings = sum(1 for tc in self.test_cases if tc.findings)
        return {
            "methodology": self.name,
            "version": self.version,
            "total_cases": total,
            "completed": completed,
            "coverage_pct": round(completed / total * 100, 1) if total else 0,
            "cases_with_findings": with_findings,
        }

    def blocked_cases(self) -> list[TestCase]:
        return [tc for tc in self.test_cases if tc.status == TestStatus.BLOCKED]
```

## Best Practices

- Base methodology on established frameworks—don't reinvent from scratch
- Version control your methodology and test case library
- Include 'not applicable' as a valid status—document why tests were skipped
- Require evidence for every finding—screenshots, request/response, code snippets
- Peer review reports before delivery—quality issues erode client confidence
- Update methodology after every major engagement with lessons learned

## Detection

```yaml
title: Security Testing Methodology Detection
id: 48a7f192-456f-4554-be2c-c80babb17d6e
status: experimental
description: Detects suspicious activity related to building security testing methodology techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*security*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Security Testing Methodology Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Related Techniques

- [Implementing Compliance Penetration Testing](../implementing-compliance-penetration-testing/SKILL.md)
- [Performing Wireless Penetration Testing](../performing-wireless-penetration-testing/SKILL.md)
