A.8.29: Security Testing in Development and Acceptance
Control Objective
Security testing processes shall be defined and implemented in the development life cycle.
Policy Statement
anDREa enforces a multi-layered testing ecosystem to prevent logical flaws, operational regressions, and code-level vulnerabilities within the myDRE platform. Testing is conducted continuously throughout the software development life cycle, utilizing automated code analysis, systematic regression sweeps, end-user simulation testing, and independent external auditing.
1. Integrated Security Testing Framework
Security validation occurs across four distinct operational intervals:
- Continuous Automated Testing: Static Application Security Testing (SAST) is embedded directly into the CI/CD pipeline via SonarCloud and GitHub Dependabot. Scans are triggered on every commit to flag vulnerable packages, dependency updates, or code defects.
- Per Sprint/Release Validation: Prior to any deployment into the Acceptance environment, code changes undergo mandatory Dynamic Application Security Testing (DAST) alongside manual, documented security code reviews.
- Annual External Audits: An independent, certified security firm conducts a rigorous White-Box/Grey-Box Penetration Test on the complete myDRE infrastructure and application layers annually.
- Ad-Hoc Testing Execution: Target-specific security audits or deep-dive penetration sweeps are triggered immediately following significant architectural changes or high-severity threat intelligence warnings.
2. Software Testing Life Cycle (STLC)
The operational journey of software testing follows a defined, iterative path within our engineering workflows:
[Requirement Analysis] ➔ [Test Planning] ➔ [Test Design] ➔ [Environment Setup] ➔ [Execution] ➔ [Closure]
- Requirement Analysis: Testers analyze user stories, security requirements, and acceptance criteria on the Azure DevOps sprint board. Ambiguities are immediately escalated to system architects.
- Test Planning & Estimation: Testers estimate efforts and compile a comprehensive Test Plan, which must be reviewed and signed off by the primary developers, architects, and management.
- Test Design: Structural test cases are generated on a per-Product Backlog Item (PBI) level and archived inside Azure DevOps Test Plans.
- Test Environment Setup: Managed by the development team, this isolated Azure subnet is spun up and loaded with the latest build or bug fixes before being passed over to the testing team.
- Test Execution: Testing teams systematically execute test suites via Azure DevOps, funneling discovered anomalies back to the engineering team.
- Test Closure: Testers compile a comprehensive test summary report within Azure DevOps. Once resolved, the PBI is moved to the
Ready for Acceptancestate for staging promotion.
3. Applied Methodologies & Testing Typologies
To ensure full functional coverage and defensive application behavior, testing teams apply specific testing methodologies:
- Sanity Testing: A baseline verification run immediately upon receiving a new build in the test environment to ensure application stability. Core validation components include:
- Ingress/Egress (Log-in and Log-out) verification.
- Master workspace rendering and layout loading.
- Data Request landing page accessibility.
- Workspace Owner identity mechanics (adding/removing project members).
- Functional Testing: Granular verification matching actual output behavior against documented requirements on a per-PBI level.
- Regression Testing: A full or partial selection of historically executed test cases, run based on the Regression Test Plan at the end of each sprint to guarantee that new code increments have not compromised existing application logic.
- Positive vs. Negative Boundary Testing:
- Positive Testing (Expected Behavior): Confirming that only authorized Accountable/Privileged Members can alter workspace rosters, and validating that automated compliance alert emails are sent to all project owners upon member additions.
- Negative Testing (Abuse Case Handling): Ensuring that non-privileged workspace members are blocked from altering project rosters, and verifying that standard research members cannot execute or approve external data transfer requests.
4. Acceptance Testing & Production Deployment Approval
Before code is pushed into production, the Support & Assurance Team takes operational ownership of end-to-end user acceptance workflows:
- Features and bug fixes are evaluated inside a production-like staging container.
- User Acceptance Testing (UAT) is executed against production specifications, with findings documented inside distinct tasks under the primary PBI.
- The Support & Assurance Team coordinates with the Product Owner to evaluate the build status. A production deployment requires formal joint authorization alongside finalized public Release Notes.
5. Specialized Automation Engineering
Automated API Integration Testing
To protect inter-application contracts, API surfaces, and data schemas, anDREa utilizes a dedicated regression test bench powered by Postman integrated with our release pipelines. Automated suites continuously validate core interaction planes:
Workspace API(Lifecycle and metadata management)Compute API(Virtual machine orchestration commands)Upload API(Data ingestion pipelines)
Automated User Interface (UI) Testing
End-to-end browser workflows are simulated using the Playwright automation framework, configured to enforce cross-browser capability, smart element waits, automated assertions, and continuous HTML verification report generation within our Azure DevOps pipelines.
6. Administration & Reference Registries
| Document / Console Location | Operational Purpose | Access Control |
|---|---|---|
| Periodic Controls Security | Continuous logs of security testing confirmations, DAST outcomes, and audit histories. | Authorized Personnel Only |
| Azure DevOps Test Plans | Active repository for current functional test cases, sample scripts, and UAT results. | Authorized Personnel Only |
| Regression Test Plan | Master automated test scripts and logic sweep files run post-sprint. | Authorized Personnel Only |
| Postman Team Workspace | Active repository for core tenant API interaction tests and schema contracts. | Authorized Technical Personnel |
| Playwright Repository | Node/TypeScript-based UI automation scripts and configuration suites. | Authorized Technical Personnel |
- Defect Life Cycle Rule: Software bugs discovered within the production environment are logged and tracked via formal Bug Items within Azure DevOps. Deficiencies identified during test or acceptance phases are handled flexibly using inline developer Tasks attached to the active PBI.