Security Testing
CVSS (Common Vulnerability Scoring System) is the standard scoring system used to rate the severity of software vulnerabilities. Scores range from 0 to 10: Critical (9.0–10.0), High (7.0–8.9), Medium (4.0–6.9), Low (0.1–3.9). CVSS Base scores measure inherent severity;
Security Testing
Penetration testing (pentesting) is authorized, controlled hacking to identify exploitable vulnerabilities before attackers do. A structured methodology prevents scope creep, legal problems, and missed findings. The phases: scoping (what's in scope, rules of engagement), reconnaissance (gather information), scanning (enumerate attack surface), exploitation (verify vulnerabilities), post-exploitation (assess impact)
Testing
Using production data in test environments is one of the most common compliance violations in software engineering — and one of the easiest to prevent.
Testing
SOC 2 is a certification that enterprise customers increasingly require before signing a contract.
Testing
PCI DSS (Payment Card Industry Data Security Standard) governs any organization that stores, processes, or transmits cardholder data.
Testing
Building healthcare software means operating under HIPAA's Technical Safeguards — a set of required and addressable implementation specifications that directly govern how your application must behave. Unlike other compliance frameworks that are largely process-oriented, HIPAA's Technical Safeguards translate almost entirely into testable application behaviors. A HIPAA
Testing
GDPR has been in force since May 2018, yet data protection authorities across Europe continue to hand out record fines.
IaC Testing
Compliance frameworks like CIS Benchmarks contain hundreds of controls.
Security Testing
The Sarbanes-Oxley Act (SOX) requires public companies to maintain accurate financial reporting and demonstrate effective internal controls.
Security Testing
The NIST Cybersecurity Framework (CSF) provides a flexible structure for managing cybersecurity risk.
Security Testing
FIPS 140-2 (and its successor FIPS 140-3) defines security requirements for cryptographic modules used in federal systems.
Security Testing
FedRAMP (Federal Risk and Authorization Management Program) is the U.S. federal government's standard for cloud service security.