Test Design for Security Checks

Why Test Design Matters

A check that reads a configuration value can meet thousands of different files. Nobody can test them all, so testers group inputs and pick the cases most likely to expose a mistake.

Equivalence Partitioning

Split the possible inputs into groups the check should treat the same way. For an SSH setting such as PermitRootLogin, the groups are: allowed, forbidden, limited to keys, and missing.

One case from each group is usually enough, because a mistake that affects one member of a group tends to affect all of them.

Boundary Values

Mistakes cluster at the edges of a group. If a check fails when MaxAuthTries is above 4, test 4 and 5, not only 3 and 10.

The same applies to dates, sizes and version numbers: the version just before a fix and the fixed version itself are the most useful cases.

Two Labs, Two Directions

OpenVAPT tests every check against a vulnerable lab, where it must fail, and a hardened lab, where it must pass. The first catches false negatives and the second catches false positives.

When a real machine shows a wrong result, the fix is a new test case in the lab first, then a change to the check.

In Summary

Group inputs, test one case per group, and test both sides of every boundary. A check is only trusted once it fails on a weak example and passes on a fixed one.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt explain HOST-SSH-001 and list the input groups its detection must handle.
2. Run: openvapt demo vulnerable --only HOST-SSH-001 --out p23v and openvapt demo hardened --only HOST-SSH-001 --out p23h, then compare the evidence.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P23: Test Design for Security Checks (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p23.html

@misc{openvapt_p23,
  author       = {{OpenVAPT}},
  title        = {{P23: Test Design for Security Checks}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p23.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}