A Taxonomy to Assess and Tailor Risk-based Testing in Recent Testing Standards

TL;DR

This paper introduces a taxonomy for risk-based testing to evaluate and adapt testing standards and approaches, facilitating systematic comparison and practical application assessment.

Contribution

It presents a novel taxonomy for risk-based testing that enables systematic evaluation and tailoring of testing standards and approaches.

Findings

The taxonomy effectively identifies deviations between standards and approaches.

It enables systematic comparison of different risk-based testing methods.

The approach supports practical application and customization of testing standards.

Abstract

This article provides a taxonomy for risk-based testing that serves as a tool to define, tailor, or assess risk-based testing approaches in general and to instantiate risk-based testing approaches for the current testing standards ISO/IEC/IEEE 29119, ETSI EG and OWASP Security Testing Guide in particular. We demonstrate the usefulness of the taxonomy by applying it to the aforementioned standards as well as to the risk-based testing approaches SmartTesting, RACOMAT, PRISMA and risk-based test case prioritization using fuzzy expert systems. In this setting, the taxonomy is used to systematically identify deviations between the standards' requirements and the individual testing approaches so that we are able to position and compare the testing approaches and discuss their potential for practical application.