Why Agile performance testing should be a vital part of security within banks’ software development lifecycle

Why Agile performance testing should be a vital part of security within banks’ software development lifecycle

By Keith Puzey, Blazemeter by Perforce

The longer developers and testers wait to identify software security vulnerabilities, the more costly and time-consuming they become to fix. That’s why the concept of agile performance testing is gaining traction across financial services organisations to improve the quality of their apps and has a major contribution to play in software security strategies. By implementing agile performance testing practices, developers can catch issues sooner and ensure safer, better, and more secure code.

Agile testing is a subset of Agile, the popular methodology used in various industries and increasingly as a part of software development processes. In common with its parent, agile testing takes a flexible, iterative approach that emphasises rapid and incremental changes based on immediate customer feedback. By embracing the agile approach, organisations can improve the security and quality of their code, accelerate time to market, and quickly meet customer needs. Agile testing represents a significant departure from more traditional waterfall-style approaches.

However, as is typical across most software development processes, sound theory does not necessarily equate to success. That is why it is essential to understand some of the best practices around agile performance testing. Here are some recommendations for agile performance testing strategies based on the experience of real-world customers who have made this transition.

Shift Left Testing

Shifting testing to the left is part of the foundation for agile performance testing. It means starting testing as early as possible, including after every release and software build. By comparison, waterfall testing takes place after the development process has been completed. When shifting left, an iterative feedback loop is created to help inform the subsequent stages of the software development lifecycle. This means that after security vulnerabilities (and other issues, such as performance bottlenecks) have been identified, developers are in a better position to address these rapidly before they escalate.

CI/CD pipeline integration

Integrating performance tests into automated continuous integration (CI) and continuous delivery (CD) pipelines will run more frequently, so any problems should be caught faster. At the same time, the massive amount of manual effort and risk of human error is removed.

When setting up tests, it is recommended to connect them to the context of the development workflow. For instance, a test can be triggered after every code commit to capture regressions in real time. Tests can also be scheduled to run after a specific period of time.

Simulate real-world conditions

One of the most valuable tools at any testing team’s disposal is using high-quality and relevant test data, which simulates real-world conditions that reflect actual user experiences. In turn, this makes it easier to discover security issues and other issues that could affect users — ensuring tests are far more reliable. Building realistic test scenarios based on data, or — if for a new product that does not yet have data — deep-dive discussions with product managers planning a new product to potential user stories will help.

It is also recommended to use other performance testing methods, such as load, stress, and endurance testing. In this way, the software can be tested against instances of peak traffic, for example, such as in the run-up to holidays. Automated performance tools will help to minimise the additional workload on teams.

Determine the KPIs

While what constitutes an acceptable rate of error will vary according to each organisation, it is vital to have clearly defined metrics or key performance indicators (KPIs) in place before implementing Agile performance testing. Otherwise, test results may be monitored, but seeing progress and taking the correct actions will be more challenging.

Monitor and analyse

When performance testing is happening, monitoring provides vital real-time insights into system behaviour. If performance testing tools are being used, these can alleviate the extra burden by collecting data automatically. Once that raw data is available, the next step is its interpretation. Then, compare those to the KPIs or metrics previously identified, which will help identify what needs to be improved.

Team effort

Agile performance testing is a team sport requiring collaboration between and alignment of everyone involved: developers, testers, DevOps managers, and product managers. Better collaboration is a route to faster time-to-market, better results, and more satisfied and productive teams. Typical activities to enable collaboration include shared documentation, regular sync-ups, and collective decision-making.

Iterate then adapt

Every testing cycle is an opportunity to gain valuable data that can be used to optimise and refactor code while also enhancing testing processes. For instance, it may be found that a particular test is unnecessary or that new features need new types of performance testing. Being flexible and adaptive is integral to successful agile performance testing and, after all, reflects the fundamental principles of Agile itself.

This is why it is important to recognise that agile performance is not a one-time action and must be an ongoing part of the software development lifecycle — with teams willing to change test plans, objectives, and test cases if and when required. With software increasingly becoming the frontline for how financial organisations interact with their customers, every way testing can improve not just security but also the user experience should be a priority.