How Pradeep teaches software testing - Part 4

If you didn't know how Part 4 came up? Here is how it came. I first wrote Part 1, then Part 2 and then Part 3 ;-) So, logically here is Part 4 of the series How Pradeep teaches software testing.

"I know how to do certain types of testing but if someone asks me to explain what I did, I struggle to explain" was a problem statement I heard from a tester today. I replied in a confident tone, "I know why that happens. It doesn't just appear to be your problem but I know a lot of testers who appear to have the same problem." 

I continued, "You should consciously practice explaining what you did, first to yourself and then to your colleagues although they probably know how and why you did it. Why? I am going to explain how your brain works (or how I think it does). It has two nodes. One that contains what you know and the other that controls your explanation of what you know. When you make a conscious effort, you are forcing a connection between these nodes in your brain. When you force your brain to connect those two nodes too often, at some point it will judge the need for a permanent connection and create it for you. After that you have a free flow of what you know and your explanation of what you know." 

After I said the above, I could see a smile in the face that reflects, "Yes, I now know how to solve this problem". I read a person's understanding not by their head nodding or when I hear, "I get it", but by the emotions and expressions on their face and the body. 

James Bach identified that I was a metacog. I didn't know I was one. After that, it has been very helpful for me to understand why I do things the way I do. I guess I turned myself into a metacog because I thought it suits the kind of testing I wanted to. It's not a special status, it is just a way of life.

I don't even know if the brain works the way I explained it to be but I guess you can understand why the above explanation makes sense. I make sure I tell people that I am not trying to misinform them about anything when I use such examples. I am just helping the tester imagine why there is a problem and how to solve it. A lot of my coaching is consulting.

Examples like the one you read above govern a major part of my coaching. I observe a lot. I practiced consciously making connections between what I have seen, heard, thought, experienced and know to being explain it when the context demands.

Analogies and Examples are powerful approaches to teaching. I need to know what connects to my audience very well. Although all my audience are testers, I can't use the same analogies and examples, it just doesn't work. Bangalore testers need a different example than those in Pune. In Pune, I would talk about Raj Thackery and in Bangalore I would talk about Vattal Nagraj, in Chennai about Goundamani and not about Vattal Nagraj. Now, for those of my readers from United States or Europe, you wouldn't know Goundamani or Vattal Nagraj and hence I would use examples of Chuck Norris, Sarah Palin, Julian Assange. If you are a F1 fan, I'd talk about testing through specific GP incidents. That's how the examples need to adopt based on audience. I also use a lot of examples from what I think the world connects to. For instance, I closely read and watch Air Crash Investigation in Nat Geo channel. OMG! There is so much to learn from the way NTSB (National Transportation Safety Board) deals with it. So, basically as a coach, I have to keep connecting to various thoughts and happenings to be able to connect with my audience. 

Similes, Metaphor or if you choose to call them Analogies are interesting and tough piece of cake, if you are the one providing it. People tend to take it in their own interpretation than what you intend to. It is good in a way, I get to learn when not to use what type of analogies to what kind of people :)

I use Fishing for explaining test coverage. I know a few other people have already used fishing as an example for teaching testing, so I didn't invent it but I know how to explain different concepts of testing with the fishing example. I think that most learning happens when you are interacting with the audience and not when you are explaining. That's where I do better with the fishing analogy.

I start drawing different types of fish, from guppies to clowns and from star fish to sharks. I then draw a size and shape of a specific type of net to catch fish. I give them a goal of catching as many different fish as possible in a limited amount of time. Some audience come back and tell me, "Ah with this net the guppies will escape"... what's your immediate thought? You would tell them to build a net that has smaller squares to catch guppies?  (Why say it? They know it) I would probably be Pradeep and say, "Fantastic. A lot of time spent celebrating the success of finding one good bug steals away the opportunity to find more good bugs. How do you want to celebrate? 3 minutes left."

So, after they come out with strategy and different nets, I tell people that just because they have nets (tools) to catch a specific type of fish it doesn't mean they can really catch a plenty of it. I then tell a story and examples from my life. One of them: I consulted for an organization who had bought an expensive automation tool hoping that they would now be able to find more bugs. They spent all their energy to set up tests on it and found fewer bugs over the year. I drive points like: Tools don't help you unless you know how to help the tools to do what you think they can.

For a while people think it is possible to catch a shark from a net. It is possible, maybe. I explain how a powerful shark can bring their boat down if they try to catch it through a net or a fishing rod and how a harpoon is better than a net. Sometimes people try to think of similar approaches to solve many different problems. The example of shark, net and harpoons are cool for people to relate to something they have done in the past that shouldn't have been done the way they did it. I then equate different types of fish to different quality criteria. I ask my audience what type of fish are they mostly catching and I hear a shout, "Functionality". 

After a lot of back and forth between me and my audience, we all discover what good test coverage could mean. I then start probing into their projects and figure out how much of fish they are missing that they shouldn't be and try to help them understand why they shouldn't be catching too much of the same fish. Sometimes it upsets the food chain :) 

While there is fishing in my class, there is also plenty of room for Sine and Cosine for Test Techniques, Brian Marick's Minefield Analogy for Regression Test Strategy, Tom and Jerry examples for How Scripted Testing is dangerous, what lessons can we learn from Saurav Ganguly's come back, how to read Sachin and Kambli's career graphs, farming... It must be fun to sit in my class. I don't know, I have never been able to.

Happy New Year!

TASTRO - Tester's Astrology by Rrajesh Barde

One of Moolya's customer, a large IT company in India wanted me help a group of testers think beyond the boundaries they had accustomed to. They wanted me to help them bring out the potential and creativity of testers within their organization. Having thousands of testers,  they did know where to start from - the top 30 they had. Top 30 in terms of demonstrated passion for software testing.

The icing on the cake, they wanted their testers to progress towards becoming brainual testers.

A group of 30 testers were introduced to me and I spent time for a couple of weeks with them on various activities. We ended up doing so many good things together that we accomplished the mission together. There were plenty of great work that they did. Now, those 30 have been successful in inspiring 30 more and this chain reaction is appearing to happen. If it goes on, I am sure this organization is going to rock in the coming years.

Somebody impressed with how I mentored these 30 asked me, "Aren't you giving away all secrets of how testers in Moolya test?", to which I replied, "There is no secret. This is how we test and this is how we live". There is nothing to hide. We don't have any secret ingredient or a secret ingredient soup unlike many services companies. We have watched KungFu Panda and hope you too have watched it. We focus on our skills. Our website tells that story.

In this post, I want to highlight the creativity that came out of the exercises of Brainual Testing.
Rrajesh Barde surprised me that he had been reading my blogs ever since I started it and he told me he had also commented on it. I was glad to meet my oldest (well, he's pretty young) blog reader. The only question I asked him was, "Was it worth your time?"

This guy turned out to be hyper creative. He had a sense of humor, lateral thinking, passion to test, leadership and creativity. We were brainstorming of how do we educate testers without letting them know they are educated. Of course, books are boring to most. What content do we feed them with? We discussed on Andy Glover's Cartoons for it. However, that didn't solve the problem of testers within their organization being able to see Andy working with them.

So, Rrajesh Barde in the meeting interrupted, "If I may, I have an idea..." and then came out with this brilliant idea of TASTRO - Testers ASTROlogy. In a country like India, a lot of people refer to Astrology. They at least want to read if there is something good in it for them. I thought that was a brilliant idea and we had to develop it further. We needed to mix fun and pun into it. We needed the learning touch. We needed people to look forward to their weekly TASTRO.

Here is what we got:

TASTRO – Tester’s Astro – What do your test signs foretell?

Aries		Your stars look good for coming week however you might face an environment downtime. Why not make a quick checklist on how to set it up?
Taurus		Avoid calls during Rahu Kaal. Those who have calls with your on-site coordinators during this time, Beware!!
Gemini		The planetary movements suggest that the build scheduled on week day will be delivered to the Testing team on Friday after sunset. You have plenty of time to read Rapid Software Testing Appendix and practice new testing ideas.
Cancer		Though you think you know it, you have no certainty until you try. You might see a surprise appreciation for your smart work. Smart work could mean, you use oracles to test.
Leo		You are worried with unplanned work load. Read the book – Lessons Learned in Software Testing at home and you may see the change in office.
Virgo		Worried why you your productivity appears to have come down? How long has it been since you took a break? Quick breaks between test sessions are important.
Libra		In the busy times, be prepared to work late, eat pizza for dinner at work, and work for some weekends. Don't wanna do that? Go beyond test cases, you will find more bugs.
Scorpio		There is a chance that your relationship with developers would go sour in the coming week. So treat them with chocolates. Developers are rich source of information for a tester.
Sagittarius		Your customers would be under the influence of aggressive Mars. You would be forced to test whatever is thrown at you. Check for the mission to be achieved to avoid falling into traps
Capricorn		You would be trying to achieve the stars by clicking here and there with your monkey paws. Stop doing that and your career could get better.
Aquarius		Your managers would somehow have a strong notion that you have just been marking those test cases as “pass” without executing them. Honesty is important for a good tester.
Pisces		When you have crashed the software and waiting for the system to boot, prepare your own test idea cheat sheet. For those who do, future has been bright.

Isn't this awesome? I feel testers like Rrajesh Barde are a huge boon to our industry. The beauty of my consulting was, I felt there wasn't just one Rrajesh Barde I met but many. I may cover about others in future posts.

A couple of years ago, I used to go to a consulting assignment as though I am superior and I consult people because they were inferior. These days, I go to consulting to get humbled by people like the ones I met.

Please, everybody, stretch out your creativity, you would find an Andy Glover or Rrajesh Barde in you. For those who want to follow Rrajesh's blog, here is the link. He came out with another concept called Bug Burji (Burji is a dish made out of Egg and we call it Egg Burji, Rrajesh made a Bug Burji out of it). Rrajesh, you inspire me. I hope after reading your work, a couple of others may join me in admiring your work and contribution.

I am telling myself that I was born to witness this beginning of the golden era of software testing. Don't know if you can even see what I am experiencing.

How Pradeep teaches software testing - Part 3

I hope you have read Part 1 and Part 2 of the series of "How Pradeep teaches software testing" and I welcome you to the Part 3. I don't yet know how many parts it is going to take for me to complete this series. I am hoping that I would write down the most important parts and keep adding whenever I need to update. In this part, I am going to focus on my journey of doing exercises and hands on stuff I do at my workshops.

Having been a guinea pig of James Bach and Michael Bolton's online coaching, I myself went through quite a few exercises that were under experimentation. I still remember James showing me a set of pens and then hiding all of them away from me but one to ask me which one was being shown to me. All of them looked identical so it was difficult to tell which pen was he showing me. I had to figure out a way to question him to help me identify the difference between those pens. This is one such exercise that didn't make it to the Rapid Software Testing class. However, I benefited from all of them.

When I started to teach my own version of Rapid Software Testing in India, I sought permission to use a few exercises from the original version. I got permitted to use the Mysterious Spherical Ball and Dice Game. Oh, the Triangle, too. I needed more and I had to create my own.

Even before that, I had to modify the exercises to suit me and the point I wanted to drive. I did that. I have a few variations of the game and exercises and at times I drive a different point from the original one. If I were to have been a parrot repeating what they taught me, I wouldn't have been able to survive or inspire people.

I tried my own exercises. I tried them out with James & Michael. It was hard to teach them back something with my exercises. That made my exercises or my ability to deal with them stronger. I then tried it out on a couple of testers here in India and it worked wonders. So, I consciously didn't take all of my exercises to James & Michael. Not that I wanted to avoid them but as their good student, I wanted to appreciate their time. I first wanted to get good at something before asking them to work on it.

I published some exercises on my blog. For instance the telephone puzzle and other brainstorming exercises helped me to experiment some of my own.

Every time I did the same exercise with new batch of testers, a new idea or an approach used to emerge that used to teach me a lot. I started to focus on what testers in India need to learn. If their fundamental is flawed then it is not good to teach them some things that appear to be Greek and Latin.

I made a list of things that I think is fundamental and started to work towards exercises for the same.

I am listing a few of them below

Skills

• Observation
• Questioning
• Lateral Thinking
• Reverse Engineering
• Scripting
• Investigation

Technical

• Test coverage
• Testability
• Mission focus
• Heuristics & Oracles
• Bug Reporting

I built exercises for each category I wanted testers to get good at. As an example, I built an exercise for reverse engineering practice for testers: Finding Nemo  . Sorry to Mac folks unless they have a Windows emulator in it.

I wondered if I could really help in creating good testers with my crazy set of exercises and ideas. I was consulting for Edista Testing Institute and sought an opportunity to experiment my crazy ideas with two batches of fresh college graduates. The results were beyond imagination. I could bet on these testers against all of the ISTQB passed fresh college graduates put together. Here are excerpts of the work that they produced after a month of training from me. 

I was all the more convinced about creating my own exercises to help creating good testers in India. As an evidence of how skilled a tester could get beyond those 30 days is here - Santhosh Tuppad, my student of the fresh college graduate training is now a co-founder of Moolya Software Testing Private Limited. Not just he, other testers from those batches are top testers in the organization they are working for. There are a few in them who haven't yet made it large but if you talk to them you'd know it may happen, if not today, tomorrow.

He is the youngest testing entrepreneur to the best of my knowledge at the age of 23 and this story being created in India and me playing a small role in it makes me happy of the path I am heading towards in coaching software testers. I am specifically going to write about my students and their journey after attending my training in a part dedicated to them.

The exercises created curiosity in them to learn more. So, I didn't do the learning for them, they did it for themselves. What every training for a software tester needs to do - is to create curiosity with pointers of how they could do it. What ISTQB is doing is a super reverse of that. They damage the gene when it is being built and create business opportunities to themselves in the context of helping such genes upgrade and repair.

Some of the ISTQB trainers in India who perceive that my work has an influence on them, use some of my exercises in their workshop. I allow them to do so because that's the best hope for me that someone would then question the value of what is being taught as ISTQB and get curious to learn about testing.

My exercises teach people to test their own ideas of testing. I'd like to build thousands of them and give it away. Over the last few years, I have seen lot of action from Context Driven Testing folks on the exercises. People come up with their own exercises and share it with others. It is the safest community to be in irrespective of whether you agree to the principles or not. People like Sebi, Markus Gaertner, Matt Heusser are the ones on top of my head who contribute testing exercises to the world.

You will have fun cracking my Finding Nemo exercise. You would trick yourself to believing you have cracked it and then if you do a few more tests, you'd discover you haven't. Santhosh and I worked on something called Guess the Password - Version 1 & Version 2 . Don't go to Version 2.0 before completing Version 1.0.

This is what I am doing in India. This is how I coach testers. The future is all about such testing exercises, if it were to be a bright one. So, all of India isn't all that bad in testing as you may be imagining it to be. Note that!

In future parts of the series, I am going to be covering on aspects of my interaction with testers in the class, humor that works for me in my class, feedback and what I did with it, interacting with trainers in software testing and lots more. Stay tuned, it looks to be completely safe.

How Pradeep teaches software testing - Part 2

I just hope you all read Part 1 of this series. Now, I bring to you Part 2 where I talk about my journey of my first set of workshops.

In 2007, I was not sure if people would be willing to listen to my ideas in testing. I had some good readership for my blog and I announced 2 hour free talk on exploratory testing titled Mirchi Test Masala. Mirchi in Hindi means "spicy" and I wanted to offer the Indian Spicy Testing flavor during my talk. By God's grace, I was flooded with interest from my blog readers to host me for this talk at their organizations.

I happened to be invited in companies like Dell, Huawei, Celstream, Ionidea, Hasten Technologies and even at an organization in Chennai. There were few more organizations who happened to invite me a couple of months later looking at the blog post. I forgot some of their names. It could have been big or small ones.

This was an opportunity for me to test my public speaking skills, my ability to coach testers and also a test of how influential I could be to testers. I used a bug in Microsoft Powerpoint 2003 as an exercise to drive certain points to the audience and help them see testing as an exploration than merely test case execution.

This also gave me an opportunity to face some tough questions from audience and there was a stiff resistance to my ideas. Being an outspoken context driven tester in India wasn't one bit easy. There was a huge wave against the ideas I was trying to spread. Whatever resistance I faced didn't matter much because people saw an extreme passion for testing in me and they were acknowledging it well. That was a huge boost to my confidence that I can actually do a full day workshop.

I guess in early 2007, Michael Bolton did a Rapid Software Testing training for a client in Bangalore. That client had chosen a venue for coaching which was "rent a training room" types. I decided that I should do my first workshop in the same place because the vibrations that Michael left there would help me boost my confidence. I payed a lot of money to book the same room. That is where I did my first workshop on Exploratory Testing.

I was surprised (yeah, I was) that there were about 17 people who were willing to pay as much as 3500 INR for a day to get trained by me. I guess I paid more than half of that money on rental of the training room but I was happy. I don't distribute feedback forms because I believe the actual feedback is when people go back to their workstations and test out the new ideas.

Somehow, people were convinced that I was giving them a different perspective. My workshop was mostly hands on. Minutes before I started my workshop I pinged Michael and said, "I need your blessings on this important day in my life. I am nervous" and he replied, "Are you an expert presenter?" and I answered, "No". He then said this great thing, "Well then pretend to be an expert presenter". That helped me so much that I pretended to be an awesome presenter. Over the years, I have developed a stage presence that audience have loved it in most occasions.

What I seemed to gain is many different ways to run the same exercise. However, my audience were my asset. They asked so many questions to me that helped me do a lot better thinking to help them learn what they wanted to. Sometimes I appear to people as the king of analogy and examples. I connect with my audience well because there were my audience of past who taught me so much about how to do it and how many different ways I could fail trying to give an analogy.

There is at least one good thing I tell in all my workshops: If you want to disagree with what I am saying and stay silent just because you don't care about me, you are killing the testing community indirectly. I am going to be doing these workshops to many other testers and I don't want to keep telling stupid stuff to them, so please help me.

That statement has helped some people tell me where I am bad and where I need to do better. After I engage them in a conversation and if I was convinced about it, I made necessary changes.

A big thank you to all those who attended my first set of workshops. You made this guy grow in confidence and helped him learn how bad he is and how good he needs to get. The most useful feedback has mostly not been on feedback forms.  

My monopoly in teaching exploratory testing in India

This is a conversation I had with a good friend of mine. She is passionate about teaching testing and has changed her teaching style tremendously over the last couple of years.

I have changed a few words and broke down sentences from the conversation to make it more reading friendly. So, Mansi, when you read this and you spot anything that I have goofed up, please correct me.

Mansi: You are a monopoly for teaching exploratory testing in India.

Me: Yes, thank you. ( Of course, MB and JB visit India )

Mansi: How do you feel about it?

Me: I feel bad but also feel good.

Mansi: Good and bad?

Me: No, Bad and then Good.

Mansi: Why would you feel bad?

Me: I feel good because it helps me make money that gets me to feed my family and myself. I feel bad because being an evangelist of exploratory testing in India, I haven't seen people wanting to teach exploratory testing or even if I have seen, they aren't pursuing it.

Mansi: Oh, you know why people don't want to teach exploratory testing in India?

Me: That's what I have been trying to find out.

Mansi: Its because of you!

Me: You mean, I am the blocker for someone teaching exploratory testing in India? That's funny.

Mansi: You have set an entry barrier to them.

Me: What kind of an entry barrier have I set? I have been asking all my students to consider practicing to teach exploratory testing and I am willing to help them out. Why would I set entry barriers?

Mansi: Well, what I mean by entry barrier is, you would intimidate them with a lot of questions on their effectiveness to teach and all that.

Me: If I ask questions about how they plan to teach, why should they get intimidated by that? As a matter of fact, I would ask questions to them to see if I could help them not do the mistakes I did. I may learn to do a new exercise for my class from them.

Mansi: Because you are THE guy for exploratory testing in India.

Me: James Bach would hate to hear that. I am not an authority trying to prevent anyone from doing anything they want to. Look at you, Mansi, your class is filled with hands on exercises these days as opposed to your past of running through slides. I think I have helped you do what you love to.

Mansi: Yeah, thats all there but I am using exercises that I learnt from you for a class on testing. I don't teach exploratory testing per se.

Me: Oh, you mean, you don't teach exploratory testing by using the title exploratory testing?

Mansi: You play with words.

Me: I am just trying to understand.

Mansi: See, this is what I was telling.

Me: I intimidated you?

Mansi: No, your view of things are different.

Me: So, is yours and thats why we are friends and have a lot to talk to each other.

Mansi: OK, so tell me, why haven't testers in India want to teaching exploratory testing despite you doing so many workshops on it?

Me: Maybe because they enjoy doing exploratory testing than teaching it. Maybe they are working on the skills and one of them might start to do it. Or just as you are doing, "Not by that title".

Mansi: ... or maybe they are intimidated?

Me: You are free to think anything but here is what I can tell to all people. James Bach and Michael Bolton didn't teach me how to teach but they did teach me how to learn things. I carefully observed how they coach testers and tried to ape them initially. I must have failed aping them but in that process, I also found my own style of coaching that appears to be working for me. If I had thought that James & Michael has set an entry barrier for me to teach exploratory testing, I would have been stuck with that idea and wouldn't have progressed at all.

Mansi: I agree but its fun to have such conversations with you.

Me: Convert the fun of conversations with me to some action.

_ end of conversation with Mansi_

So, to any Indian tester reading this. I have been enjoying a beautiful monopoly of teaching exploratory testing in India. Look at my workshops and events page, you'd know I must have done lots of them. Going forward, I am going to be doing a lot, too. I think I am going to go out of India this year and do these workshops. I am enjoying this monopoly not because I am a bully and have intimidated people or set an entry barrier for someone nor I am an approving authority. There is no certified exploratory testing coach certification that you should get to be able to do it. I am enjoying this monopoly because of people like you not seizing the opportunities dancing in front of you.

Here's how I started: I announced free 2 hour talk on exploratory testing on my blog and a couple of organizations invited me to do it. I got free practice doing exercises for testers and developers as my audience and in turn I faced a number of questions. After doing enough talks, I got an idea of what would work for me and then graduated to announce my one day workshop. After doing that for enough number of times and most importantly by gaining experience doing one day workshop, I moved to doing two days. I tried doing Rapid Software Testing, Testing Skills Workshop and Exploratory Testing. Found my sweet spot, worked on a few exercises of my own + borrowed some from James & Michael (with their permission) and tried things.

After a few months, my students started contributing exercises to my workshop. I started to recognize the problems that testers and managers face in India to get Exploratory testing mainstream into their projects and started to do "Accountable & Manageable Exploratory Testing workshop". Session Based Test Management got into mainstream of my workshop and this led to me consulting and helping organizations achieve this. Today, I have success stories with Indian testers, managers and most importantly organizations that beat the s*** out of all other testing training done in India. Again, its you, dear Indian testers, who make me feel like that. So, if you see me as a big ego out there, ask yourselves, "how have I contributed to it?". If you don't know the answer, then here it is, "You have contributed more to my success than what I have done to myself" although I appear to take complete credit. Jon Bach wrote a beautiful blog post on the testing moment around the same topic.

On the other side of my analysis is that more than 99% of Indian testers are not career risk takers. Most among them think, they have taken enough risk in their career by choosing testing.

So, someone coming out of their so called permanent job in India wanting to teach exploratory testing or becoming a consultant is so unlikely. It may happen but that would definitely be surprising to me. If you dare, get in touch with me, please.

While you would just continue to read or maybe enjoy my blog posts, I would continue to play a monopoly for exploratory testing in India. What a shame!

Coaching testers how to email and influence stakeholders

One of the ways Moolya is going to become a great organization is by attracting, hiring and retaining good testers. Sreenuraj Varma who won our heart for this blog post asked us if he could work for Moolya. We got him to test things out and send us test reports.  We found that we liked him to work with us and he liked to work with us. So, we hired him a couple of weeks ago.


Before the project work kicks off, I asked him, what he'd like to develop himself on and he made a list of things that impressed me. I then sat with him to get more specific and identified "writing influentially" as one of the things he wanted to develop. I created an exercise and got him to work on it. I have done this before so I knew what to expect.


I wrote down the goal he had to accomplish:

You are hired as a tester in a team and in your first week you discover that there are many important tests that the team is missing. Your objective is to send a mail to all test team members pointing out the tests they are missing and the impact it has on the project.

To consider:

·         You are new to the team

·         The team has lot of experienced testers and they know about the project more than you

·         You don’t know how they would take your advice

·         If your English is bad some people may not take your advice seriously

·         This email can help you build or break your credibility with the team

So, he worked on it and got back with the following:

Dear All,

For the last week I was going through the application and the important bugs reported on each module. I feel like there is a lack of concentration on the issues related to security, which I feel important because the application is meant to be used by common people and also the modules are designed to be getting in-cooperated with the bank API’s where there is a possibility that we may lead our users to compromise their valuable details.

As we are in the stage of completion of second round of testing I would suggest that it will be good if we can do a quick analysis in the area of security were our application have to be  checked for most common security issues.

Looking forward for your suggestions

-- Sreenuraj


I then reviewed the above email with him stating things that is causing me to not think of it as an influential email and provided specific feedback and asked him to work on it. After a couple of hours, he came back with the following

Dear All,

Last week I was going through the application and was learning the work flow happening in the important modules. I have also gone through the first and second phase test reports we have for the modules. But I think we have not done a security testing for our application. I feel it is important because of the following reasons.

a)      Loss of customer confidence

b)      Can increase the web sites down time (reinstalling services, restoring from backups etc)

c)       Harm to our brand

When I was in module “A” which is the most important one, I found that some basic validations missing for the text fields. No checking was found for validating the special characters. This is found repeated in almost every module I have gone through. Below I am mentioning some of the issues I have came across.

a)      Cross site scripting is possible in almost every module

b)       Data tampering is allowed

c)       The cookies which are used in one session can be used again

As we are in the stage of completion of second round of testing I would suggest that it will be good if we can do a quick analysis in the area of security were our application have to be  checked for most common issues.

Looking forward for your suggestions

Thanks&Regards

Sreenuraj Varma M

Yo, I again sat with him for the next set of feedback about why I still think the email is not influential enough and pointed him to links such as An open letter to the Prime Minister of India by Rajdeep Sardesai.

He read through it, gained some ideas and started to work on the next version of it.

Hi Team,

This is Sreenuraj recently recruited for the position Software tester for the organization. My last week assignment was to learn the project work flow and to refer the available documents which QA holds against each modules of the project like test plans, reports, bug reports etc.

As we are in the completion of second phase I think we have covered almost all the important things in functionality testing. Most of the bugs are fixed and retesting for the same is also done. But some of the bugs reported against the security testing done in important modules are found to be in open state. I have also noted that some of the bugs were raised in the first stage of testing. Because of that I think the number of issues reported against security testing in the second phase have gone down. Also there is no status report available for those bugs from the development side.

Below mentioned are some of the important issues I have came across in the application which was not found in the bug reports may be not reported because of the above said reasons:

a)      The validations for text boxes in the Login screen and the home page for special characters were missing.

b)      User is allowed to insert html scripts into the text fields for the above said pages.

c)       The data which is submitted for the module “A” can be tampered and user is able to alter the data which is transferred .(Bypass the client side validations)

d)      Data tampering was also success in the module “B” where file type can be changed and user is able to include a file with unsupported extension (like exe .. )

Some of the points I would like to suggest are

1.       - Before the completion of phase 2 of testing we should conduct a security testing in the application for the important modules and report the issues found.

2.       - Discussion with the development team in regards with the Issues reported and which are still in open stage, also record the status before second phase of testing ends.

3.      -  It will be good if we can conduct a workshop/training session for both the development & testing team where importance of security related matters in the project can be discussed. Also we can emphasis on client’s expectation in the area of security which is described in the requirement document.

Looking forward for your suggestions

Thanks & Regards

Sreenuraj Varma M

Nah Nah! Not good enough for me. After having coached many testers, I have gained wisdom to understand the point at which I have to step in and do something different than saying, "Not good. I hope you work on these points". So, I decided to send him, my version of the same.

Dear Team,

Greetings!

It is a pleasure to be starting to work with you. In just a week, I was glad to discover that there is great energy you people are bringing in. Its motivating for me to work with you. As I see that a new team member brings in fresh and different value, I'd like to present some kind of value addition I could do.

In this email, I'd like to bring a few points to your notice that might interest you. I am aware that some of the points I am going to bring up here might already be known to you all but I felt it is my responsibility to let you know of what I found.

Security issues for NNNCC Web App (Just an example)

• I found that the directory listing is enabled. As we hold confidential information with us and not all pages are exposed to all users, we might be in a position of risking our customers data.
• I found that there are error messages that can be customized at the URL. For example, I can make an error message saying, "As Pradeep is on leave, we can't service this" to appear from the page by editing the URL.
• I also found that there is a way to bypass the security by storing and using cookies of previous session. When our customers use a public machine to access their data, we are risking the customers data to be known to others who may discover cookies.

Based on the above, I'd like to make a few humble suggestions:

• I understand that the focus is on getting our software functionally right but on the effort of trying to get that, we appear to be sacrificing security.
• I would love your opinions on budgeting for security testing for every release henceforth. As I am a new hire to this project, I would take up the responsibility for testing security for the next couple of releases till I ramp up on other things.
• I would be extremely delighted to meet with you all on this, so am planning to setup a meeting on Friday 24th Feb 3 PM. I have looked into your calendars and have chosen the mutual free time. I am open to suggestions of other date and time.

Thanks and Regards,


-- Pradeep Soundararajan

This time, he came back with the notes he made about this exercise while continuing to work on the skill of writing influential emails. This is going to go to a point where he would learn to practice on his own. He in on the third exercise with me working on test strategy. Our clients are going to be happy to have him on the team. He is showing lots of enthusiasm, hard work and effort. We are happy.

At Moolya, we are going to lay emphasis on how people write and communicate. We might sound stupid but we have realized that people who can write well, get things done quicker and better. In my own consulting experience, I took an email which had not received a favorable response from the management and helped the test team re-write it. We waited for a day and there came a response to it and things got moving.

Add "influential emailing" to your wanna have skills if you are a tester. There's a good example to it in Michael Bolton's blog as well. I am working on a tutorial to help testers write and communicate influentially to stakeholders. Maybe I will take it Star East or Star West.