Give your expert comments on how security testing takes a different mindset than functional QA testing?

Give your expert comments on how security testing takes a different mindset than functional QA testing?

Security testing in many ways is similar to functional testing but the main difference is of mindset. In case of functional testing we focus that the features should work for end user that means the application does what they expect and does not hinder them in completing their tasks. Where as in case of security testing the end user is like an attacker who would try to break the application is all possible ways. So our focus should be more on proving that a specific attack scenario does not succeed. Security testing when done properly goes deeper and even beyond the functional testing. Security testing aims to eliminate the aspects of systems that do not relate to application functionality but to the reliability, confidentiality and availability of applications A functional QA engineer can typically think up a variety of methods to verify the functionality of a feature or component. The attention of functional testing is much more focused on how to enable the customers to perform their tasks in the easiest and most convenient way possible while providing enough checks and safety measures so that user can't cause unintentional harm too easily. But a security tester needs to go deep. He has to think nasty, considering the cases that shouldn’t be allowed to a typical user and user’s can perform only those tasks they are authorized to perform. By testing the security of your application and being prepared, software hackers will be more likely to focus on applications that have not properly tested.