Describe how security testing differs from ordinary functionality testing. What are the criteria for passing a security test that differ from functional criteria?

What will be an ideal response?

Security testing must also test the “and nothing else” criteria (absence vs. presence)—security functionality must do exactly and only what is specified in the requirements. The “and nothing else” criteria are generally unique to security functionality.