When can security testing be considered functional testing, and when non-functional?

Security testing is related to functional testing when it checks the implementation of specific security requirements outlined in the specification, for example:

• Verification of the correct operation of authentication and authorization mechanisms.
• Testing the application of password policies (length, complexity, expiration).
• Validation of input data to prevent injections (SQL, XSS).
• Access control testing based on user roles.

In this case, it tests what the system does in terms of security according to explicit requirements.

Security testing is related to non-functional testing when it assesses the reliability and resilience of the system against various types of attacks and threats, as well as its compliance with security standards regardless of specific functional requirements. Examples:

• Penetration testing to identify vulnerabilities.
• Vulnerability scanning.
• Source code analysis for potential security issues (Static Application Security Testing - SAST, Dynamic Application Security Testing - DAST).
• Denial of service testing under DDoS attack conditions.
• Compliance testing with security standards (GDPR, HIPAA, PCI DSS).

Here, the focus is on how well the system is protected and how it behaves under load or malicious actions.

The key difference is that functional security testing verifies the execution of declared security functions, while non-functional testing assesses overall quality and resilience of the protection.