Know about Security Testing

Introduction:

Security testing checks whether software is vulnerable to cyber attacks, and tests the impact of malicious or unexpected inputs on its operations. Security testing provides evidence that systems and information are safe and reliable, and that they do not accept unauthorized inputs.

Security testing is a type of non-functional testing. Unlike functional testing, which focuses on whether the software’s functions are working properly (“what” the software does), non-functional testing focuses on whether the application is designed and configured correctly (“how” it does it).

Main goals of security testing:

• Identify assets—things that need to be protected, such as software applications and computing infrastructure.

• Identify threats and vulnerabilities – activities that can cause damage to an asset, or weaknesses in one or more assets that can be exploited by attackers.

• Identify risk—security testing aims to evaluate the risk that specific threats or vulnerabilities will cause a negative impact to the business. Risk is evaluated by identifying the severity of a threat or vulnerability, and the likelihood and impact of exploitation.

• Perform remediation—security testing is not just a passive evaluation of assets. It provides actionable guidance for remediating vulnerabilities discovered, and can verify that vulnerabilities were successfully fixed.

Need for Security Testing

The software industry has achieved solid recognition in this age. In recent decades, however, the cyber-world seems to be an even more dominating and driving force which is shaping up the new forms of almost every business.

Web-based ERP systems used today are the best evidence that IT has revolutionized our beloved global village. These days, websites are not only meant for publicity or marketing but they have evolved into stronger tools to cater to complete business needs.

Web-based Payroll systems, Shopping Malls, Banking, and Stock Trade applications are not only being used by organizations but are also being sold as products today.This means that online applications have gained the trust of customers and users regarding their vital feature named SECURITY. No doubt, that security factor is of primary value for desktop applications too.

However, when we talk about the web, the importance of security increases exponentially. If an online system cannot protect the transaction data, then no one will ever think of using it. Security is neither a word in search of its definition yet, nor a subtle concept. However, we would like to list some compliments on security.

Examples of Security flaws in an application

1. A Student Management System is insecure if the Admission branch can edit the data of the ‘Exam’ branch.

2. An ERP system is not secure if a DEO (data entry operator) can generate ‘Reports’.

3. An online Shopping Mall has no security if the customer’s Credit Card Details are not encrypted.

4. A custom software possesses inadequate security if an SQL query retrieves actual passwords of its users.

What Are The Types Of Security Testing?

• Vulnerability Scanning

Often powered by automation (manual tools exist too), vulnerability scanning is leveraged to identify known loopholes and vulnerability signatures. It is the first of many steps in vulnerability management and app/ software security. It is used to gain an understanding of the baseline of security risks.

• Security Scanning

Security scanning is the process of identifying vulnerabilities and misconfigurations in the app/ software, network, and systems. Both manual and automated tools are used for this test type. The insights from these tests are listed, analyzed in-depth, and solutions provided to fix the issue.

• Penetration Testing

Penetration Testing (Pen-Testing) is the process of stimulating a real-time cyberattack against an app/ software, system or network under secure conditions. It is (and must be) performed manually by a trusted, certified security expert to understand the strength of the security measures against attacks in real-time. Most importantly, unknown vulnerabilities (including zero-day threats and business logic flaws) are exposed through Pen-Testing.

• Security Audit/ Review

Security auditing or security review is the structured process to review/ audit the app/software against defined standards. Through gap analysis and code/ design reviews, the security of the physical configurations, operating system, information handling processes, user practices, etc. is assessed. Compliance with regulatory standards and frameworks is assessed as well.

• Ethical Hacking

Ethical hacking, broader than penetration testing, is an umbrella term that includes a multitude of hacking methodologies. Here, all vulnerabilities and misconfigurations are attempted to be exposed by simulating attacks from within the app/ software.

• Risk Assessment

Through risk assessments, the security risks facing the app/ software/ network are identified, analyzed, and classified (as Critical, High, Medium, Low). Mitigation measures and controls are recommended thereon, based on the priority.

• Posture Assessment

The overall security posture of the organization is assessed through posture assessment using a combination of security scanning, ethical hacking, and risk assessment.

What Are The 7 Attributes That Security Testing Must Include?

• Authentication

The user is digitally identified before getting access to the system through authentication. By testing and validating this attribute, the system’s efficacy in allowing only legitimate/ right users is ensured. The system could use a straightforward Username-Password or Multi-Factor authentication process (where a combination of OTP, biometrics, secure ID tokens, etc. could be used).

• Authorization

Once the user is authenticated, they gain access to the system. Their privileges and permissions to perform actions within the system is defined based on user roles and limited by authorization. For instance, it is determined by the authorization attribute if a specific user can modify data, access certain files, and so on.

• Confidentiality

By testing the confidentiality attribute, it is verified whether the information, services, and resources are accessible only to intended users and only when requested. The tester can

identify if unauthorized users are accessing privileged resources.

verify if all data is encrypted.

analyze the format in which data is displayed when requested, etc.

• Availability

When the availability attribute is tested, the tester can understand if the software/ app is up and running round-the-clock with minimal accepted downtimes (from regular maintenance and upgrades). The availability of information and services upon request and backup files in case of failures is verified too.

• Integrity

It is verified through the integrity attribute if

information received is unaltered in transit.

correct and updated information is presented as per user groups, privileges, and restrictions.

• Non-Repudiation

Here, the denied access requests along with Timestamp and IP address are tracked. It is confirmed by the tester if the user is genuine and not a security threat.

• Resilience

The resistance to face internal and external attacks by the system is checked through the testing of the resilience attribute.

Conclusion

Successful cyber-attacks and breaches are known to erode trust, reputation, and financial resources. Conducting security tests is a critical step in winning stakeholder trust.

Keeping in mind that security tests need to be highly tailored, the services of security experts like AppTrana can be leveraged to effectively perform security testing and also get instant protection as part of their Risk-based Managed Security offering to maintain a robust security posture.

!!!! Happy Learning !!!!