Testing Experience Issue 6, June 2009
The June 2009 issue of Testing Experience was given over to security testing. It carried an article on the OSSTMM, and the same year the publisher launched a sister title for IT security.
Magazine archiveIssue 6 of 28Updated
Browse all 28 issues
Every issue with its date and theme, and the twelve that have their own page.
Open the issue indexThe security testing issue
The issue. Testing Experience was a free, English-language quarterly for professional testers, published in Berlin by a testing consultancy and training company and edited by Jose Diaz. Issue 6 appeared in June 2009 and took security testing as its theme. It was one of the first issues in the run built clearly around a single subject, a pattern the magazine followed through 2009 to 2011 with agile testing and open source testing tools.
What it covered. The issue's known content is an article on the OSSTMM, the Open Source Security Testing Methodology Manual, a methodology for measuring operational security by testing rather than by checklist. Other articles in the issue are not covered here. An article introducing the OSSTMM to a software-testing audience fits the magazine's habit of bridging communities, and the theme mattered enough to the publisher that it launched Security Acts, a sister magazine for IT security, later in 2009.
In 2009 a security test was an annual engagement; in 2026 static analysis and dependency scanning run on every commit, and the penetration test comes last.
Security testing in 2009 and the OSSTMM
Security testing in 2009. In 2009 security testing and functional testing were usually separate worlds. Functional testers rarely thought of themselves as responsible for security; security work was done by specialists, often from outside the company, in an engagement scheduled once a year or before a major release. A tester who read the June issue was most likely meeting a structured security methodology for the first time and asking where it could fit in a test plan they already owned. Web applications were the main concern. Cross-site scripting and injection flaws headed the OWASP Top 10 of 2007, and many of the defects a penetration tester reported were ones a functional tester could have found with the right test cases, had anyone asked them to look. That gap between the two groups is the one the issue's theme spoke to.
The OSSTMM in plain terms. The section 'OSSTMM in plain terms' of the security testing guide is the current introduction for that reader: it explains the five channels (human, physical, wireless, telecommunications and data networks), the distinction between what is visible, accessible and trusted, and the rav as a result another tester could reproduce. Table 1 in the same guide compares five types of security testing by lifecycle stage, what each finds and misses, and who usually runs it, and the closing five-item list (adding abuse cases to every story is the first item) gives a tester without a security background a place to start this quarter. It is an independent explanation; it is not the 2009 article and does not reproduce it.
What changed and where to read now
How the practice has changed. The methodology landscape moved after 2009. The article was written against OSSTMM 2.x; OSSTMM 3 was published by ISECOM in 2010 and introduced the rav in the form the guide describes. On the application side the OWASP Testing Guide was at version 3 (2008) when the issue appeared; version 4 followed in 2014 and the renamed Web Security Testing Guide reached version 4.2 in 2020, organised around numbered test identifiers that a pipeline can reference. NIST SP 800-115, the US technical guide to security testing and assessment, dates from September 2008 and is still the document most regulated buyers cite. The larger change is where the testing happens: in 2009 a security test was an annual engagement; in 2026 static analysis and dependency scanning run on every commit, and the penetration test comes last, which is how Figure 1 of the security testing guide orders the activities.
Where to read about it now. Start with the security testing guide for the methods and their place in a delivery pipeline. The Security Acts page covers the sister title the publisher started after this issue. Because security findings compete for the same limited test time as everything else, the risk-based testing guide shows how to rank them with a likelihood-times-impact matrix and decide how deeply to test each area. The original issue is not distributed here; to cite it, give Testing Experience, issue 6, June 2009.
Then and now
Guides that continue this subject
- Testing TechniquesSecurity testing: types, OSSTMM and where it fits in delivery
- Test ManagementRisk based testing: scoring, effort allocation, worked example
Questions
What was in issue 6 of Testing Experience?
Its theme was security testing, and it carried an article on the OSSTMM, the Open Source Security Testing Methodology Manual. Other contents of the issue are not covered here.
Is the OSSTMM article available here?
No. This site does not distribute the original issues. The security testing guide explains the OSSTMM as part of a current overview of security testing methods.
What is the relationship between this issue and Security Acts?
The same Berlin publisher launched Security Acts, a magazine for IT security, in late 2009, after the June security testing issue. The Security Acts page describes it.
Who edited Testing Experience?
Jose Diaz was the editor of the magazine, which appeared quarterly from March 2008 to December 2014.
Where do I read about security testing now?
The security testing guide in the Testing Techniques hub covers the OSSTMM and the main types of security testing, and shows where each sits in a delivery pipeline.
