Certified Tester Security Test Analyst (CT-STA)
Overview
The ISTQB® Certified Tester Security Test Analyst (CT-STA) certification focuses on the analytical, planning, and risk management aspects of security testing. As software systems face increasingly complex security threats, expanding attack surfaces, and growing regulatory requirements, understanding which assets need protection, the security risks they face, and how attackers might exploit vulnerabilities is essential for effective security testing.
The CT-STA certification provides professionals with the knowledge and skills to identify and assess security risks, understand attacker motivations and approaches, define appropriate security test objectives and strategies, and plan security testing activities throughout the software development lifecycle. It also addresses risk management, security controls, regulatory requirements, and the interpretation of security test results to prioritize vulnerabilities and recommend appropriate mitigation actions. By connecting security testing with business priorities, Security Test Analysts help organizations make informed security decisions and strengthen their overall security posture.
Audience
The Certified Tester Security Test Analyst certification is aimed at anyone involved in software testing who has an interest in information security, particularly those responsible for planning, analyzing, managing, or evaluating security testing. This includes people in roles such as software testers, test analysts, technical test analysts, test managers, quality assurance professionals, security test analysts, and security managers.
This certification is also appropriate for professionals who need to understand information security from a management and business risk perspective, such as project managers, quality managers, business analysts, risk management professionals, compliance professionals, IT managers, and management consultants.
Content
ISTQB® Certified Tester – Security Test Analyst (CT-STA)
Assets and Their Security Risks
Asset Security
Understanding Attacker’s Mindset
The Attacker Mindset and Their Methods of Operations
Insider and External Attacker
Understand Relations Between Risk Management, Control Systems and Regulations
Risk Management
Internal Control Systems
Defining Test Activities from Regulations
Defining Test Objectives, Security Test Strategy and Milestones
Security Test Objectives and Security Test Strategies
Security Test Activities
Specifiying Work Packages for the Security Test Analyst
Defining Security Test Work Packages
Creating a Security Test Plan based on Security Test Work Packages
Interpreting Test Results and Defining Actions
Interpreting Test Results
Acting Upon Test Results
Exam Structure
- No. of Questions: 40
- Passing Score: 29
- Total Points: 44
- Exam Length (mins): 90 (+25% Non-Native Language)
Business Outcomes
Individuals who hold the ISTQB® Certified Tester – Security Test Analyst certification should be able to accomplish the following business outcomes:
- Explain assets and their related security risks.
- Understand Attacker mindset.
- Understand relations between risk management, control systems and regulations.
- Define test objectives, Security Test Strategy and Activities.
- Specify work packages for the Security Test Analyst.
- Interpret test results and define actions.
More Information
Training is available from Accredited Training Providers (classroom, virtual, and e-learning). We highly recommend attending accredited training as it ensures that an ISTQB® Member Board has assessed the materials for relevance and consistency against the syllabus.
Self-study, using the syllabus and recommended reading material, is also an option when preparing for the exam.
The ISTQB® Certified Tester Foundation Level (CTFL),v4.0 or previous versions, is a prerequisite for the CT-STA certification.
The Certified Tester Security Test Analyst (CT-STA) and Certified Tester Security Test Engineer (CT-STE) certifications provide complementary competencies in security testing. CT-STA focuses on security risk analysis, test strategy, planning, and the interpretation of results, while CT-STE focuses on the technical design, execution, and reporting of security tests. The certifications can be pursued independently or together to develop a more comprehensive understanding of security testing
