Business and technology qualifications, Levels 3-6, in Brussels. Explore qualifications
Portal login

Security Testing

CYB501

Course CodeCYB501
ECTS

Course Description

This unit provides learners with an understanding of security testing methodologies, and of the tools used to identify and exploit vulnerabilities in web applications and mobile applications. Learners will acquire practical skills in vulnerability assessment of exemplar web and mobile applications using industry-standard security testing tools and will gain an introduction to reporting on identified vulnerabilities. Learners are also introduced to ethical and professional considerations for security testing.

Course Objectives

This unit provides learners with an understanding of security testing methodologies, and of the tools used to identify and exploit vulnerabilities in web applications and mobile applications. Learners will acquire practical skills in vulnerability assessment of exemplar web and mobile applications using industry-standard security testing tools and will gain an introduction to reporting on identified vulnerabilities. Learners are also introduced to ethical and professional considerations for security testing.

Key Topics

  1. LO1: Understand a range of security testing methods.
  2. LO2: Be able to perform essential web application security testing.
  3. LO3: Be able to perform essential mobile application security testing.
  4. LO4: Understand the ethical and professional standards in security testing.

Course Outline

WeekTopics
1The need for security testing: definition and benefits for organisations
2Security testing approaches: SAST and code review, DAST, IAST, penetration testing (black/white/grey box), red and blue teaming, human testing, threat modelling (STRIDE, DREAD), audits and compliance
3Web application security: key features from a security perspective
4OWASP Top Ten web risks (injection, XSS, insecure design, broken access control, misconfiguration), CSRF and SSRF
5Web security tools lab: Burp Suite, OWASP ZAP and vulnerability scanners
6Evaluating web security tools: strengths and limitations, automated vs. manual testing
7Mobile ecosystem: app architecture and storage, iOS vs. Android security models, app stores and code signing, permissions, authentication and data encryption
MidtermMidterm evaluation
9Mobile vulnerabilities: OWASP Mobile Top 10, jailbreaking and rooting risks
10Mobile security analysis: CVSS scoring, remediation strategies, least-privilege permissions and session management best practice
11Ethics and professional standards: confidentiality and integrity, EC-Council and ISACA codes, responsible disclosure
12Applying Security Testing in practice: case studies
13Assignment workshop: research, planning and referencing
14Assignment workshop: drafting, feedback and improvement
15Review and coursework completion
FinalFinal assessment and submission

Learning Outcomes

  1. LO1 Understand a range of security testing methods.
  2. 1.1 Describe the role of security testing in protecting cyber systems.
  3. 1.2 Explain the different approaches to security testing.
  4. 1.3 Analyse the distinct roles that different security testing methodologies have in improving the security of cyber systems, and the advantages and disadvantages of different approaches.
  5. 1.4 Analyse the role of ethical hacking within the broader field of cyber security testing.
  6. LO2 Be able to perform essential web application security testing.
  7. 2.1 Describe the key features of web applications, from a security perspective.
  8. 2.2 Explain common web application vulnerabilities and attack techniques.
  9. 2.3 Analyse web browser vulnerabilities and their impact on security.
  10. 2.4 Use web security testing tools to identify vulnerabilities in web applications.
  11. 2.5 Evaluate the effectiveness of security tools in identifying, preventing, and mitigating web-based threats.
  12. LO3 Be able to perform essential mobile application security testing.
  13. 3.1 Describe the defining features of mobile applications, from a security perspective.
  14. 3.2 Explain common security vulnerabilities and attack vectors for mobile applications.
  15. 3.3 Use mobile application security testing tools to uncover and address vulnerabilities.
  16. 3.4 Analyse the security of mobile applications based on vulnerability assessments and propose solutions.
  17. LO4 Understand the ethical and professional standards in security testing.
  18. 4.1 Describe a range of existing professional codes of ethics.
  19. 4.2 Explain the importance of professional ethics and standards in penetration testing.
  20. 4.3 Analyse the legal considerations in conducting security tests.
Back to programme
Scroll