<?xml version="1.0" encoding="UTF-8"?>
<org.eclipse.epf.uma:ArtifactDescription xmi:version="2.0" xmlns:xmi="http://www.omg.org/XMI" xmlns:org.eclipse.epf.uma="http://www.eclipse.org/epf/uma/1.0.6/uma.ecore" xmlns:rmc="http://www.ibm.com/rmc" rmc:version="7.5.1" xmlns:epf="http://www.eclipse.org/epf" epf:version="1.5.1" xmi:id="-1V7xKIl3_oTMM79CSHbEXw" name="security_test_policy,_AiJHAAZkEd2FwrEz_Q9ftg" guid="-1V7xKIl3_oTMM79CSHbEXw" changeDate="2008-06-27T11:35:14.609-0700" version="7.5.0">
  <mainDescription>&lt;p>&#xD;
    The policy should include the following information, organized by role (Security Auditor, Tester, Developer):&#xD;
&lt;/p>&#xD;
&lt;ul>&#xD;
    &lt;li>&#xD;
        Test environment&#xD;
    &lt;/li>&#xD;
    &lt;li>&#xD;
        Test approach, techniques, processes&#xD;
    &lt;/li>&#xD;
    &lt;li>&#xD;
        Automated tests to perform &#xD;
        &lt;ul>&#xD;
            &lt;li>&#xD;
                Application&#xD;
            &lt;/li>&#xD;
            &lt;li>&#xD;
                Infrastructure&#xD;
            &lt;/li>&#xD;
            &lt;li>&#xD;
                Noninvasive&#xD;
            &lt;/li>&#xD;
            &lt;li>&#xD;
                Invasive&#xD;
            &lt;/li>&#xD;
            &lt;li>&#xD;
                Custom&#xD;
            &lt;/li>&#xD;
        &lt;/ul>&#xD;
    &lt;/li>&#xD;
    &lt;li>&#xD;
        Manual tests to perform&#xD;
    &lt;/li>&#xD;
    &lt;li>&#xD;
        Vulnerabilities to exploit&#xD;
    &lt;/li>&#xD;
    &lt;li>&#xD;
        Vulnerability prioritization criteria&#xD;
    &lt;/li>&#xD;
    &lt;li>&#xD;
        Reports to generate&#xD;
    &lt;/li>&#xD;
&lt;/ul></mainDescription>
  <purpose>To provide a way to capture the aspects of security testing that are common for all of the applications tested within an&#xD;
organization: types of security tests, who should perform them, at what level and when.</purpose>
</org.eclipse.epf.uma:ArtifactDescription>
