Security measures protect Web systems from both internal and external threats. E-commerce concerns and the growing popularity of Web-based applications have made security testing increasingly relevant. Security tests determine whether a company’s security policies have been properly implemented; they evaluate the functionality of existing systems, not whether the security policies that have been implemented are appropriate
Primary task in security testing over web applications

• Application software
• Database
• Servers
• Client workstations
• Networks