Category: Tech Learning Journey

ทำงานเป็น QA อยู่ในทีมที่ต้องทำงานเกี่ยวกับเรื่อง Authentication , Authorization

หลายครั้งที่รู้สึกว่าฟังคำศัพท์ของ Secuirty ไม่รู้เรื่องเลยว่าตอนนี้คนในทีมกำลังพูดคุยอะไรกัน

เลยเป็นที่มาให้มาลงเรียนหัวข้อนี้กับทาง IBM ผ่านทาง Coursera

หลังเรียนจบ คลังคำศัพท์เกี่ยวกับ Security เพิ่มมากขึ้น รู้จัก Tools ต่างๆเพิ่มมากขึ้น ถือว่าคุ้มค่าที่มาลงเรียน

หวังว่าความรู้ที่ได้เรียนไปแล้วสามารถนำมาประยุกต์กับงาน QA ได้ดียิ่งขึ้น

ขอขอบคุณ IBM มา ณ ที่นี้ด้วยครับ

---

Working as a QA in a team dealing with Authentication and Authorization, I often found myself lost when listening to discussions about security terms. I barely understood what my teammates were talking about, which led me to enroll in this course with IBM through Coursera.

After completing the course, my vocabulary in security has significantly expanded, and I’ve gained knowledge about various tools. It was definitely worth taking this course. I hope the knowledge I’ve gained can be effectively applied to improve my QA work.

A big thank you to IBM for this amazing learning opportunity!

https://coursera.org/share/723bc25ceccf70223f09f6050fc7ab35

---

Module 1 Glossary: Introduction to Security for Application Development

Term	Definition
Access control	Security measures employed to govern and control the access and permissions provided to users, processes, or entities operating within a system or network.
Alerting	Responsive component of a monitoring system that performs actions based on changes in metric values.
Application layer	The seventh and topmost layer of the OSI model is used by developers for building and deploying applications.
Application Programming Interface (API)	A collection of guidelines, protocols, and tools that allow diverse software applications to communicate with each other.
Asymmetric encryption	When different keys are used to encrypt and decrypt.
Authentication	Process of verifying a user’s identity.
Authorization	Process of determining a user’s access rights.
Checksums	Derived values from data employed to identify errors that may have occurred during the transmission or storage of that data.
CI/CD	CI/CD, which stands for continuous integration (CI) and continuous delivery (CD), creates a faster and more precise way of combining the work of different people into one cohesive product.
CI/CD pipeline	The continuous integration/continuous delivery (CI/CD) pipeline is an agile DevOps workflow focused on a frequent and reliable software delivery process.
Code scanners	Provide vulnerability reporting and insights after they scan code in your repositories.
CodeSonar	A static code analysis tool from GrammaTech used to find and fix bugs and security vulnerabilities in source and binary code.
Container scanning	Scans code deployed to containers, which may contain vulnerabilities and security threats.
Containers	Executable software units in which application code is packaged along with its libraries and dependencies in common ways to run the code anywhere, whether it be on a desktop, traditional IT, or the cloud.
Coverity	An incremental analysis scanner for programming languages such as C, C++, Java, and Python.
Cryptographic keys	Essential tools used to secure data from cyberattacks during transmission and storage.
Cryptographic service	A confidentiality service that keeps data secret. Its purpose is to secure data from others, even when the data traverses a non-secure network without the necessary credentials.
Data link layer	The second layer of the OSI model transforms the transmitted raw data into a line free from undetected errors.
DevSecOps	DevSecOps (DevOps with an emphasis on security) is a set of practices that automate security integration across the software development lifecycle (or SDLC), from original design to integration, testing, deployment, and software delivery.
Dialog control	Refers to the management and coordination of communication sessions between two devices or systems.
E-commerce transactions	Refer to the buying and selling of goods and services over the internet.
Encryption	Process of encoding information so that only those users with authorized access can decode it.
Endpoint security	Detects application and system anomalies and protects systems, servers, and various types of devices connected to a network.
Exhaustive documentation	Security pattern documentation that is accessible, precise, easy to read, and follow through. Software developers are inclined to refer to such documentation.
eXtensible Access Control Markup Language (XACML)	A standard used to define and implement access control policies. It offers a comprehensive framework for managing and enforcing access control decisions across different systems, applications, and services. This empowers organizations to regulate resource access and specific actions based on established policies.
eXtensible Markup Language (XML)	A widely utilized markup language created to organize, transport, and structure data in a format that is human-readable and platform-independent.
Firewall	A network security device or software that acts as a barrier between a trusted internal network and an untrusted external network like the internet.
Functional Verification Test (FVT)	Validates the software’s functionality using the solution specification document, design papers, and use case documents.
GitHub	An online platform that offers version control for software development projects, enabling developers to collaborate on code, monitor changes, and manage their source code repositories in a distributed manner.
Hash algorithms	A hash algorithm, also referred to as a hash function, is a mathematical procedure that accepts input of any size and generates a fixed-size output called the hash value or hash code.
Hashicorp’s Vault	An open-source, identity-based secret and encryption management tool.
Hijacking	A type of cyberattack in which an unauthorized person or entity intercepts and manipulates communication between two parties who believe that they are directly communicating with each other.
Hypertext Transport Protocol Secure (HTTPS)	Used for secure communication between computers over the World Wide Web (WWW). It ensures that the data exchanged between the browser and the website remains confidential and protected from unauthorized access.
Identification and Access Management (IAM)	Important security mechanisms to grant permissions to applications and systems within cloud infrastructures.
Integrity	A cryptographic service that guarantees data has not been modified or tampered with during or after reception and helps support the anti-tampering of data for users needing data verification between sender and receiver.
Interoperable	The ability of diverse systems, software, or components to collaborate, function cohesively, and exchange information effectively and seamlessly.
Intrusion detection	The ongoing detection of any cyberattacks, threats, or intrusions that may compromise an application or system.
Linux kernel	Core component of an operating system that provides a platform for running programs and various services on top of it.
Man-in-the-middle attacks	A type of cyberattack wherein the attacker covertly intercepts and potentially modifies the communication between two parties who are under the impression that they are directly communicating with each other.
Message digests	Cryptographic hash functions used to compute checksums of data blocks. It can also be used to sign and verify signatures.
Network firewall	A security device or software that serves as a protective barrier between an internal network, like a corporate network, and an external network, such as the internet. Its role is to regulate and observe incoming and outgoing network traffic.
Network layer	The third layer of the OSI model handles data transmission and control of the subnet.
Network mapper (Nmap)	Used to discover hosts and services on a computer network by sending packets and analyzing responses.
Network security	Detects application and system anomalies and monitors a network using a network tool such as Nmap or Snort.
Open Systems Interconnection (OSI model)	Enables communication between diverse communication systems using standard protocols.
Open-source software library (OpenSSL)	A library of software that implements the Secure Socket Layer (or SSL) protocol. It is an open-source toolkit to ensure secure communication with cryptography for all types of communication, from personal to commercial and e-commerce transactions.
Orchestration	The automated configuration, management, and coordination of computer systems, applications, and services.
OWASP	Open Web Application Security Project
PGP	Pretty good privacy
Physical layer	The lowest layer of the OSI model transmits bits of raw information.
Presentation layer	The sixth layer of the OSI model focuses on the syntax and semantics of data being transmitted from one point to another.
Private key	A confidential piece of information utilized to demonstrate ownership of digital assets.
Process for Attack Simulation and Threat Analysis (PASTA)	A risk-based model that connects to business objectives and technical requirements.
Public key	A cryptographic key used for the encryption and validation of digital signatures.
Public key cryptography	A public cryptographic algorithm that uses public and private keys. Rivest, Shamir, and Adleman (or RSA) is the most popular implementation of public key cryptography. RSA provides secrecy, authentication, and encryption for anyone to use. It is also used to implement prime number generation to generate private keys using different sizes of key lengths depending upon the level of encryption needed.
Role-based access control (RBAC)	An access control framework that regulates resource access according to predefined roles. In an RBAC system, users are allocated specific roles, each linked to a set of permissions that determine the actions or resources accessible to users within that role.
Scrum framework	A framework under which individuals may handle complicated adaptive challenges while producing high-value goods in a productive and creative manner.
Secure shell (SSH)	Secure connection protection for connecting with remote devices, such as physical and cloud servers.
Secure Socket Layer (SSL)	A protocol based on encryption technology that provides secure data transmission over the internet. It ensures that data exchanged between a web browser and a web server remains confidential and protected from unauthorized access during transit.
Security Assertion Markup Language (SAML)	Facilitates the exchange of authentication and authorization data among various entities. It enables smooth and secure authentication across diverse domains, empowering users to access multiple applications and services using a single set of credentials.
Security pattern	A set of rules that represent and define a reusable solution to recurring security threats or issues. By following security patterns, organizations establish robust security frameworks while ensuring the confidentiality, integrity, and availability of the system’s data.
Security pattern catalog	Empowers software developers to review and choose security patterns for developing necessary and additional security features for their application code. When developing for deployment, a well-classified security pattern catalog enables developers to reuse security patterns across multiple applications. Software developers also rely on security pattern catalogs to become more aware of the associated security mechanisms.
Serverless computing	A cloud application development and execution model that lets developers build and run code without managing servers or paying for idle cloud infrastructure.
Session layer	The fifth OSI model layer establishes multiple sessions from different machines while establishing consistent sessions if a crash occurs.
Snort	A network intrusion detection and prevention system that provides real-time analysis of network traffic.
Snyk Code	An integrated development tool that performs semantic analysis to discover coding and security bugs throughout the development phase.
Software Development Lifecycle (SDLC)	A framework that specifies the steps involved in software development at each stage. It details the strategy for developing, deploying, and maintaining a program.
Spoofing	A form of network attack that involves manipulating network traffic or data to gain unauthorized access to systems, services, or users.
Static Reviewer	Eliminates well-known vulnerabilities. It is a component within the Security Reviewer suite, compliant with frameworks including the Open Web Application Security Project (or OWASP), Common Vulnerabilities and Exposures (or CVEs), and the National Institute of Standards and Technology (or NIST).
STRIDE	STRIDE means Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privileges. STRIDE, which came from Microsoft, evaluates applications and systems to find threats and vulnerabilities.
Subnets	A subnetwork (or subnet) is a smaller portion of a larger network partitioned to create more feasible segments of the network with higher efficiency.
Symmetric ciphers	Cryptographic algorithms that use the same key for both encryption and decryption of data.
Symmetric encryption	When the same key is used for both encrypting and decrypting.
System-call auditing	The retrieval and review of system-call information from a kernel, such as the Linux kernel.
Threat modeling	Provides a process to analyze ongoing threats and eliminate the potential for software coding weaknesses and vulnerabilities.
Threat monitoring	Scanning code repositories and containers to find security issues. Password mishandling, protocol insecurities, and incorrect permissions are examples of issues that you can discover with threat monitoring.
Token management	Involves the procedures and protocols employed in handling and controlling tokens, which are unique pieces of data or strings used in diverse systems and applications.
Transport layer	The fourth layer of the OSI model accepts transmissions or data from the network layer and chops them into smaller units or packets for passing them back to the network layer.
Transport Layer Security (TLS)	A protocol based on encryption technology used to secure communications over a computer network. It is the successor to SSL and is designed using an advanced encryption algorithm.
Two-factor authentication	This added security measure is employed to safeguard user accounts and digital data. It demands that users present two distinct forms of identification before obtaining access to a system, service, or application.
Unified Modelling Language (UML)	Can visually model and represent a system for a better understanding of the system’s architecture and design.
Visual, Agile, and Simple Threat (VAST)	An agile methodology with application and operational threat models. VAST uses process-flow diagrams to represent the architectural perspective.
Vulnerability patching	The distribution of security updates or patches improves functionality or eliminates vulnerabilities in an IT system or service.
Vulnerability scanner	A specialized software tool designed to detect and evaluate security ineffectiveness in computer systems, networks, applications, and other digital assets.
Vulnerability scanning	The search for security vulnerabilities from within the code and outside of an application.
Web services security	A set of measures and protocols implemented to ensure confidentiality, integrity, and authentication of data exchanged between web services and their clients over the internet.

---

Module 2 Glossary: Security Testing and Mitigation Strategies

Term	Definition
Ad hoc testing	Random, informal testing without a plan for the discovery of a vulnerability.
BDD-Security	A security testing framework that uses behavior-driven development.
Burp Suite	A vulnerability scanner that is popular for scanning web applications. You can set up automated scans of a website or perform manual scanning by crawling the overall structure of a website or web application.
Code review	In code review, you use automated static analysis security testing and perform manual code inspection.
DAST	Dynamic application security testing (or DAST) evaluates the application from the outside in through the front end.
Dynamic analysis	Dynamic analysis is the process of testing and evaluating an application as it is executing.
Exploratory testing	Takes place outside of formal testing.
GitHub SCA	It is for viewing dependency packages and vulnerabilities while using GitHub.com.
GPL	General Public License.
Guantlt	A security framework that hooks into security tools for simplified integration.
Integration tests	For testing the integration of several coded classes within an application. You can perform integration tests across application tiers and a wide testing scope.
IAST	Interactive Application Self-testing (or IAST) scans for vulnerabilities during testing.
JSON	JavaScript Object Notation.
Mittn	Popular tool suite to include in continuous integration.
Nessus	It is a vulnerability scanner that scans operating systems, network devices, and critical infrastructure for vulnerabilities, threats, and compliance violations.
OWASP	Open Web Application Security Project.
OWASP Dependency-Check	It is an SCA for checking for vulnerabilities within project dependencies.
OWASP Dependency-Track	It is an SCA for identifying any risks within the software supply chain.
OWASP Software Component Verification Standard	It is a community-supported effort to build a sustainable framework for reducing risk within a software supply chain.
RASP	Runtime Application Self-Protection (or RASP) looks for assaults in the production environment.
Runtime protection	Runtime protection is a modern security mechanism that shields applications against threats while the applications are running.
SALSA	Supply-chain Levels for Software Artifacts (or SALSA) provides a security framework for improving integrity and preventing tampering by implementing standards and controls.
SAST	Static application security testing (or SAST) examines source code to identify security flaws that render your organization’s applications vulnerable to attack.
SCA	Software component analysis (or SCA) is the process of determining which open-source components and dependencies are used in your application.
SCM	Source control management.
Security testing	Security testing provides a secure code baseline for development. It should be performed on all new codes to reduce the risk of impacts.
Snyk	A developer security platform for securing code, dependencies, containers, and infrastructure as code.
Static analysis	Static analysis examines all code or runtime binaries to help detect common vulnerabilities without executing code or running programs.
SWID Tags	Software Identification Tags (or SWID Tags) are standard to track software installed on managed devices.
Unit testing	For testing classes and methods to evaluate application programming interface (or API) contracts. You can perform unit testing on individual classes with limited scope.
Vulnerability analysis	It is a method of identifying possible application flaws that could jeopardize your application.
XML	Extensible Markup Language.
ZAP	Zed Attack Proxy (or Zap) is a vulnerability scanner. It is an OWASP tool and open-source software that uses spiders to crawl web applications.

---

Module 3 Glossary: OWASP Application Security Risks

Term	Definition
Blind cross-site scripting	Injects a script that has a payload to be executed on the backend of an application by the user or the administrator without their knowing about it.
Broken access control	When attackers can access, modify, delete, or perform actions outside of an application or system’s intended permissions.
Buffer overflows	One of the four pervasive types of SQL injection attacks. This happens when a program allocates more data in a buffer than the buffer can store. A buffer overflow causes a system or program to crash or execute malicious code.
Code injection	One of the four pervasive types of SQL injection attacks.
Credential stuffing	Occurs when an attacker has a list of legitimate usernames and passwords. The attacker employs automation to use those passwords in an attack.
Cross-site scripting	When an application takes untrusted data and then sends it to a web browser without proper validation or escaping. You may see cross-site scripting represented as ‘XSS.’
Cross-site scripting attack	Can deface websites by replacing or removing images or content.
Function call injection	One of the four pervasive types of SQL injection attacks.
HTTP Host header injection	When creating URIs for links in web applications, developers typically use the HTTP host header available in the HTTP request that is sent from the client side. An attacker can exploit this practice by sending a fake header that contains a domain name that, for example, can be used to corrupt the web cache or password reset emails.
Lightweight Directory Access Protocol (LDAP) injection	Exploits websites that construct LDAP statements from data provided by users. In this type of attack, an attacker might modify LDAP statements using a local proxy in order to execute arbitrary commands (granting permissions to unauthorized queries) or modify the content of the LDAP tree.
Logstash	A data processing pipeline that collects, parses, and stores logs for future use. IBM Financial Crimes Alerts Insight with Watson (FCAI) uses Logstash to collect and normalize log files.
Operating system command injection	OS command injection, also termed shell injection, is a web security vulnerability where an attacker can execute arbitrary operating system (OS) commands on a server running an application and can fully compromise it along with all its data.
OWASP	Open Web Application Security Project, launched in 2001 and formally formed in 2004, is a foundation that focuses on software security. OWASP supports the security industry with the OWASP Top 10.
OWASP Top 10	A report that identifies current software security vulnerability concerns and represents a consensus from the OWASP core team, security analysts, security organizations, and other security experts. The OWASP Top 10 is used globally as a standard check for web application security.
Principle of Least Privilege (or PoLP)	Users should only have the minimum permissions necessary to perform their tasks.
Reflected cross-site scripting attack	A reflected cross-site scripting attack injects a script to be reflected from the attacked server to users on a system.
Server-side request forgeries (SSRF)	A server site attack that results in sensitive information being disclosed or leaked from the backend server of the application.
SQL injection	Takes advantage of the SQL syntax to inject commands that can read or modify a database or compromise the meaning of the original SQL query. In this type of attack, an attacker can spoof an identity; expose, tamper with, destroy, or make existing data unavailable; or become the administrator of the database server.
SQL injection attacks	Attempt to exploit web application vulnerabilities by concatenating user input with SQL queries. If successful, these attacks can execute malicious SQL commands using a legitimate web application connection.
SQL manipulation	One of the most common types of SQL injection and an attack that modifies an SQL statement of set operations.
Stored cross-site scripting	A stored cross-site scripting attack injects a script that becomes permanently stored in a database or on a targeted server.
Vault	Developed by HashiCorp, Vault is a token-based storage solution for managing secrets. This tool provides policies that constrain user access and privileges when users interact with a Vault server.

---

Module 4 Glossary: Security Best Practices

Term	Definition
Click	A framework for writing command line applications.
Code practices	They are part of the software development process for secure software development.
Dependencies	It adds features and functionality to the software without writing it from scratch. Dependencies are reusable code found in a library (package or module) that your code makes calls to.
Flask	It is a web framework written in Python that provides you with tools, libraries, and other features for building web applications.
Insecure development environment	It is an environment where production systems are secure, but the development environment where coding is built and deployed is a free-for-all with direct connections to the production infrastructure.
ItsDangerous	A secure data integrity dependency.
Jinja	A template language for rendering web pages.
LDAP	Lightweight Directory Access Protocol.
MarkupSafe	A security dependency for untrusted input.
Multi-factor authentication (MFA)	It is an identity verification method that requires users to provide at least one authentication factor in addition to a password, or at least two authentication factors instead of a password, to gain access to a website, application, or network.
Secure development environment	It is an ongoing process of securing the network, compute resources, and storage devices on-premises and in the cloud.
SQL	Structured Query Language.
Validating input	Validating input means checking (on the server side) that the input provided by the user or attacker is expected.
Werkzeug	A web server gateway interface.
XML	Extensible Markup Language.

---

นั่งเรียนเรื่อง Introduction to Test and Behavior Driven Development เพราะอยากเพิ่มความรู้เรื่อง TDD กับ BDD ให้กับตัวเอง

หัวข้อที่เรียน เป็นเรื่องเกี่ยวกับการพัฒนาซอฟต์แวร์สมัยใหม่ ที่นำการทดสอบเข้ามาเพื่อให้มั่นใจได้ว่า Code ที่พัฒนาทำงานได้อย่างถูกต้อง

Test Driven Development (TDD) และ Behavior Driven Development (BDD) เป็นสองแนวทางที่ช่วยให้กระบวนการพัฒนาและการทดสอบมีประสิทธิภาพมากยิ่งขึ้น

ความสนุกของหลักสูตรนี้ คือทาง Professor เป็นผู้รู้ในเรื่องที่เกี่ยวกับการ Test เป็นอย่างมาก แม้ว่าชื่อหัวข้อจะเป็น Introduction to Test and Behavior Driven Development แต่พอนั่งเรียนจริงกลับพบว่ามี Assignment ที่ให้ตัวผู้เรียนเขียน Test กันจริงๆ จังๆ ไปจนถึงการสอบ และส่ง Code งาน Test ให้ตรวจกันเลยทีเดียว

Professor สอนตั้งแต่ การวางกรอบของ TDD , BDD และเขียน Test แบบ Inside out > outside in , การเขียน Unit Test เพื่อ Test Function ภายใน , การเขียน Test สำหรับการ Test Database , การเขียน Test สำหรับการ call api การทำ mock data , การทำ Test Coverage , Gherkin syntax , Behavior Driven Development และ Python

มีอยู่ตอนหนึ่งที่ประทับใจ คือในส่วนของ Test Coverage เพราะมีอยู่ครั้งหนึ่งได้รับมอบหมายมาจากหัวหน้าว่า หาก Dev ทำการส่งงานมาให้ตรวจ ให้ทำการตรวจ Unit Test ของเขาด้วยทุกครั้ง ว่ามี Unit Test ทำมาด้วยหรือเปล่า

ตอนนั้นที่รับคำสั่งหัวหน้า ก็เข้าใจว่ามันต้องมีแนบมาส่ง แต่ตัวเองก็ไม่เข้าใจอะไรมากว่า Unit Test มันทำงานยังไง +ต้องมีรูปแบบอย่างไร เพราะสมัยตอนที่ตัวเองเป็น Dev ก็ไม่ได้ทำสิ่งนี้เช่นกัน และเมื่อมาทำงานตำแหน่งนี้ก็ถูกสอนมาว่า Unit Test เป็นเรื่องของ Dev เท่านั้น

กลับมาตอนที่ Dev เอางานมาส่ง Dev ที่ทำงานด้วยก็ Run Unit Test ให้ดูว่ามี Run กี่ Case ผ่านกี่ Case ซึ่งตอนนั้นเราก็ไม่มีความรู้จริงๆจังๆในส่วนนี้ แต่พอเรียนหลักสูตรนี้จบถึงได้รู้ว่า เราจะรู้ได้อย่างไร ว่า unit test ที่ dev ส่งมา มัน cover กับ code ที่เขียนไปแล้วจริงๆ และมันควรจะมี Tools อะไรเพื่อมาชี้ให้เห็นว่า Code ในแต่ละ Function มีตัวไหนบ้าง ที่ไม่ได้รับการ Test ?!

กับอีกตอนหนึ่งคือเรื่องของการปรับความคิดเพื่อที่นำไปเขียน Gherkin syntax ที่แต่ก่อนเคยเห็นตามบอร์ด Jira จะมี Format การเขียนประมาณ As role …, when , then , background พอจบหลักสูตรนี้ ถึงได้เข้าใจว่า “อ่อ นี่เขาเขียนแบบ BDD นี่เอง” ซึ่งหากใครเข้าใจตรงนี้ ก็สามารถนำไปเขียน Code และเขียน Test กันได้อย่างสะดวก

และตอนนี้ก็เริ่มเข้าใจแล้ว ว่าทำไม คนทำ QA ถึงได้ย้ายสายไปเป็น BA , หรือ SA กันต่อได้ง่ายนัก นั่นก็เพราะเขามีความรู้ตรงนี้แข็งแล้วนี่เอง

สรุปเรื่องที่เรียนแต่ละเรื่อง มีหัวข้อประมาณนี้

• การทดสอบช่วยยืนยันว่า Code ที่เราสร้าง ทำงานตามที่คาดหวังหรือไม่
• กระบวนการทดสอบซอฟต์แวร์มี 4 ระดับ: unit, integration, system, และ acceptance
• Test cases เป็นตัวกำหนดการออกแบบโค้ดทั้งใน Behavior Driven Development (BDD) และ Test Driven Development (TDD)
• BDD มุ่งเน้นพฤติกรรมของระบบจากภายนอกสู่ภายใน ขณะที่ TDD มุ่งเน้นการทำงานจากภายในสู่ภายนอก
• Red/Green/Refactor workflow มี 3 ขั้นตอน:
  1. เขียน unit test ที่ล้มเหลวสำหรับโค้ดที่คุณต้องการให้มี
  2. เขียนโค้ดพอเพียงเพื่อให้ผ่านการทดสอบ
  3. ปรับปรุงโค้ด (refactor) เพื่อเพิ่มคุณภาพ
• Nose เป็น Python test runner ที่สามารถเพิ่มสีในผลลัพธ์การทดสอบและเรียกใช้เครื่องมือ code coverage
• Test fixtures ช่วยกำหนดสถานะเริ่มต้นก่อนและหลังการทดสอบแต่ละครั้ง
• Factories และ fakes มีประโยชน์สำหรับการสร้างและจัดการชุดข้อมูลทดสอบขนาดใหญ่
• Patching เป็นเทคนิคในการ mocking ที่นักพัฒนาสามารถเปลี่ยนพฤติกรรมของการเรียกฟังก์ชัน
• Mock objects คือวัตถุที่เลียนแบบพฤติกรรมของวัตถุจริงในลักษณะที่คุณควบคุมได้
• Behavior Driven Development (BDD) เป็นแนวทางการพัฒนาที่เน้นการทดสอบก่อน เพื่อให้แน่ใจว่าแอปพลิเคชันทำงานตามที่คาดหวัง
• ระดับที่เหมาะสมสำหรับการใช้ BDD ในกระบวนการทดสอบซอฟต์แวร์คือการทดสอบ integration, system, และ acceptance
• Workflow ของ BDD มี 3 ขั้นตอน:
  1. สร้างตัวอย่างหรือสถานการณ์เพื่ออธิบายพฤติกรรมที่ต้องการ
  2. รันตัวอย่างเหล่านั้นเป็นการทดสอบอัตโนมัติ
  3. เขียนการทดสอบเพิ่มเติมตามความจำเป็น
• การสร้างสเปค BDD ต้องเขียนฟีเจอร์และเขียนสถานการณ์โดยใช้ไวยากรณ์ Given, When, Then
• Context เป็นตัวแปรที่ถูกส่งเข้าไปในทุกนิยามของขั้นตอน
• การแทนค่าตัวแปร (Variable substitution) ช่วยลดจำนวนขั้นตอนที่จำเป็นและเพิ่มการนำกลับมาใช้ซ้ำ

หลังเรียนจบแล้วรู้สึกขอบคุณทีม IBM และผู้ที่สร้างหลักสูตรนี้ขึ้นมามากๆ เพราะเรียนจบแล้วรู้สึกว่าได้ประโยชน์ และหวังให้ Dev ,QA หรือ BA เองก็ดีได้มาเรียนหลักสูตรนี้กันก่อนได้ไปเริ่มทำงานจริง โดยเฉพาะทีมที่ทำงานเป็น Agile และมี Automated Test…

---

I’ve been taking a course on Introduction to Test and Behavior Driven Development because I wanted to expand my knowledge on TDD and BDD.

The course focuses on modern software development, incorporating testing to ensure the code works as expected. Test Driven Development (TDD) and Behavior Driven Development (BDD) are two approaches that help improve both development and testing efficiency.

What I found enjoyable about the course is how knowledgeable the professor is about testing. Even though the course is called Introduction to Test and Behavior Driven Development, it turns out that we had real assignments where we had to write tests ourselves. There were actual coding exams where we had to submit our test code for evaluation.

The professor taught everything, from the framework of TDD, BDD, writing tests from the inside out and outside in, creating Unit Tests to test internal functions, testing databases, testing API calls, mocking data, handling Test Coverage, using Gherkin syntax, Behavior Driven Development, and Python.

One part that stood out to me was Test Coverage. In the past, my manager instructed me to check if developers included Unit Tests with their submissions. At that time, I knew it was required but didn’t really understand how Unit Tests worked or what they should look like. When I was a developer, I didn’t do this either, and when I became a QA, I was told that Unit Tests were solely the developer’s responsibility.

Later, when developers showed me their submissions, they ran the tests and showed how many passed or failed. At that time, I didn’t fully understand it. After finishing this course, I finally learned how to know if the Unit Tests provided by developers really cover the code, and what tools should be used to highlight which parts of the code aren’t tested!

Another part I appreciated was learning how to write the Gherkin syntax. I used to see it in Jira boards with formats like “As a role…, when, then, background”. Now, after completing the course, I finally understand that this is BDD in action, and once you understand this, you can write both code and tests much more easily.

I now also understand why many QA professionals transition to BA or SA roles so easily — it’s because they’ve mastered this knowledge.

Here’s a quick summary of what I’ve learned:

• Testing ensures that the code we build works as expected.
• There are four levels of software testing: unit, integration, system, and acceptance.
• Test cases guide the design of the code in both BDD and TDD.
• BDD focuses on the system’s behavior from the outside in, while TDD focuses on how it works from the inside out.
• Red/Green/Refactor workflow in TDD has three steps: write a failing unit test, write enough code to pass it, then refactor the code to improve its quality.
• Nose is a Python test runner that adds color to test results and can call the code coverage tool.
• Test fixtures set up the known state before and after each test.
• Factories and fakes are useful for creating and managing large test datasets.
• Patching is a mocking technique that allows developers to change how a function call behaves.
• Mock objects are objects that mimic the behavior of real ones, with control over how they work.
• BDD ensures that applications behave as intended, using integration, system, and acceptance testing.
• BDD workflow has three steps: create examples/scenarios, run them as automated tests, and write additional tests if needed.
• When writing BDD specifications, we use Given, When, Then syntax.
• Context is a variable passed into each step definition.
• Variable substitution reduces the number of steps needed and maximizes reusability.

After finishing the course, I’m very grateful to the IBM team and everyone involved in creating this course. I feel that it’s truly beneficial and would recommend it to developers, QAs, or BAs to take this course before starting work.

https://coursera.org/share/4420a3a647d27415de423a777ed752a6

เริ่มเรียนเรื่อง “Google Project Management Certificate”

เพื่อหวังจะปิด Gap เรื่อง Skill บริหารทีมของตัวเองที่มีอยู่น้อยนิด แต่กลับไปส่งผลกระทบหลักๆกับการทำงานที่ทำในปัจจุบัน

หลังเรียนจบไป 1 Course จากทั้งหมด 6 Course แล้วรู้สึกอึ้ง ในวิธีการทำงานของ Google มาก ไม่ว่าจะเป็นเรื่องของการจ้างพนักงานบาร์เทนเดอร์ เพื่อมาเป็นผู้จัดการโครงการ ที่ขอแค่คุณมีมุมมองความเข้าใจลูกค้า คุณก็น่าจะสามารถเป็นผู้จัดการโครงการได้ (แล้วบาร์เทนเดอร์ผู้นั้น ก็มาเป็น 1 ใน Speaker ผู้เล่าเรื่องให้ผู้เรียนฟังแถมยังทำงานกับ Google มาเป็น 10 ปี)

หรืออีกเรื่องก็คือเรื่องของ Process การบริหารงาน จากเดิมที่เคยคิดว่า Agile มันน่าจะเจ๋งสุด ดีที่สุดกับทุกงาน

แต่หลังเรียนไปแค่ 1 Course กลับพบว่า Google นั้นยืดหยุ่นมาก ไม่ใช้กระบวนการเพียงอย่างใดอย่างหนึ่ง

แต่ใช้ทั้ง Agile , Water Fall , Six sigma มาทำงานร่วมกัน ให้เหมาะไปกับงานในแต่ละประเภทที่จะต้องทำงานด้วยนั่นเอง

หลังจบ Course แรก คิดว่าส่วนที่ยากที่สุด ของงานนี้ น่าจะเป็น Interpersonal skill (ทักษะการสื่อสารกับทีม หรือทักษะการสื่อสารกับบุคคล) เพราะความไม่เหมือนในวัฒนธรรมต่างชาติ ที่มีอะไรแล้วพูดตรงๆ กับวัฒนธรรมไทยที่มีอะไรแล้วไม่พูดแต่เก็บเงียบ หรือบางทีเลือกเอาไปนินทา แบ่งพรรคแบ่งพวก ไม่สื่อสาร ทำให้ทีมขาด Motivate (แรงจูงใจในการทำงานร่วมกัน) ซึ่งเจ้าส่วนนี้ก็เป็นส่วนสำคัญ ที่เป็นตัวชี้วัด ว่างานมันจะไปได้ดีหรือมีปัญหา ก็สามารถดูกันได้ที่ตรงนี้แหล่ะ

https://coursera.org/share/8a5ec141f1a3c075299f017323bf7021

All men by nature desire to know.

— Aristotle