Security testing course: from certified QA to ISTQB Security Tester

Understand the main application vulnerabilities, model an application’s threats and prioritize testing effort according to risk. Each session lasts 2 h.

Week 1 — Application security basics

• S01 — The security tester’s role, place in the lifecycle, legal and ethical framework, rules of engagement
• S02 — OWASP Top 10: a structured overview of the main vulnerabilities
• S03 — Authentication security: mechanisms, common weaknesses
• S04 — Authorization and access control: privilege escalation, insecure direct object references
• S05 — Session management, cookies, security headers, CORS

Week 2 — Core vulnerabilities

• S06 — Injection principles (SQL) on a practice target
• S07 — Cross-site scripting (XSS): types and detection
• S08 — Command injection and other injections, defensive principles
• S09 — Sensitive data exposure, misconfigurations
• S10 — Summary workshop: map the vulnerabilities of a practice application

Week 3 — Threat modeling

• S11 — Assets to protect, attack surface, entry points
• S12 — The STRIDE method: systematic threat identification
• S13 — Data flow diagrams (DFD): building them
• S14 — Applying STRIDE to a DFD, listing the threats
• S15 — Workshop: threat model of a practice application

Week 4 — Risk analysis and prioritization

• S16 — Security risk assessment: likelihood × impact
• S17 — Prioritizing testing effort according to risk
• S18 — Aligning test objectives with the organization’s security policy
• S19 — Risk-based security test strategy
• S20 — Competency gate P1: graded threat modeling case study

Get hands-on with the tools, test authentication, access and injections, then build security checks into a CI/CD pipeline. Each session lasts 2 h.

Week 5 — Mastering the tools

• S21 — Burp Suite Community: proxy, interception, history
• S22 — Burp Suite Community: Repeater, encoding, request manipulation
• S23 — Burp Suite Community: Intruder, limits of the free version
• S24 — Burp Suite Professional demo: active scanner, extensions
• S25 — OWASP ZAP: automated scan and manual exploration

Week 6 — Testing authentication and access vulnerabilities

• S26 — Authentication testing: controlled brute force, weak policies
• S27 — Authentication bypass on a practice target
• S28 — Testing authorization controls, horizontal and vertical access
• S29 — Session and token manipulation
• S30 — Workshop: a documented authentication and access campaign

Week 7 — Testing injections and content

• S31 — Guided SQL injection testing, reproducible evidence
• S32 — Guided XSS testing, scope and impact
• S33 — Negative tests and security edge cases
• S34 — Postman applied to request security testing
• S35 — Workshop: recording reproducible, unambiguous evidence

Week 8 — Integration into the pipeline

• S36 — Automated security checks in a CI/CD pipeline (GitHub Actions)
• S37 — Dependency analysis and the software supply chain
• S38 — Integrating OWASP ZAP into a pipeline
• S39 — Workshop: a pipeline that runs security checks
• S40 — Competency gate P2: guided exploitation of a vulnerability in session

Test API security, check configuration and compliance, write a professional report, then prepare the Capstone. Each session lasts 2 h.

Week 9 — API security

• S41 — Threats specific to REST APIs: overview
• S42 — API authentication and authorization: frequent mistakes
• S43 — Tokens, API keys, OAuth: flaws and tests
• S44 — Excessive data exposure, missing rate limiting
• S45 — Workshop: a security testing campaign on a practice API

Week 10 — Infrastructure and compliance

• S46 — Infrastructure and configuration security basics
• S47 — Security headers, TLS, basic hardening
• S48 — Enterprise context: compliance and regulatory requirements
• S49 — GDPR applied to security: personal data, minimization
• S50 — Workshop: configuration and compliance checks

Week 11 — Professional reporting

• S51 — Structure of a security report: clarity, severity, reproducibility
• S52 — Ranking vulnerabilities by severity (scale and justification)
• S53 — Remediation recommendations developers can act on
• S54 — Communicating with technical and non-technical stakeholders
• S55 — Workshop: writing the complete security report

Week 12 — Capstone

• S56 — Scoping the Capstone: perimeter, rules of engagement, threat model
• S57 — Tool-based testing campaign on the Capstone application
• S58 — Security testing of the Capstone APIs
• S59 — Writing the security report and the remediation plan
• S60 — Competency gate P3: security report review · Defense rehearsal

Two days of intensive preparation for the official exam: structured syllabus review by area, exercises, mock exams with commented answers, strategy and time management.

You receive a practice application and deliver a complete security approach: threat modeling, a tool-based testing campaign, and a security report with a remediation plan. The defense, in front of a three-member panel that includes an external security professional, focuses on justifying your choices: why this threat is a priority, how the vulnerability was confirmed, which remediation and why.

• Assessment rule: a rigorous analysis that you understand and can defend beats a pile of tools you have not mastered.