Development of a Methodology for Testing the Security of It Projects

Security testing is a necessary first step for organizations whose goal is to determine the level of information security and enhance it for strengthening the protection. There are various methodologies and standards. Each individual methodology describes a process that an organization can perform to detect vulnerabilities. Companies can either create their own internal methodology or use an existing methodology, but most often specialists conduct security testing according to well-known methods. The article deals with a comparative analysis of methods and standards for testing the security of systems, networks, and web applications. The following were considered: OWASP WSTG web application security testing methodologies, NIST SP 800-115 Technical Information Security Testing and Evaluation Manual, PTES Penetration testing standard, ISSAF information system security assessment methodology, OSSTMM open source security testing methodology, BSI penetration testing model study methodology, Positive Technologies methodology. Their strengths and weaknesses have been identified. Based on the analysis, a methodology is proposed that focuses on efficiency, ease of implementation and adaptation to various projects. The practical significance of the work lies in the possibility of its application to increase the level of security in information systems. The results of the study may be useful to information security specialists and organizations seeking to minimize the risks of cyber attacks