What is security testing and why it is so important?

What is Security Testing? 

Security Testing is described as a type of Software Testing that assures software systems and applications are free from any vulnerabilities, threats, risks that may cause a big loss. Security testing of any system is about uncovering all likely loopholes and weaknesses of the system which might end up in a loss of information, revenue, repute at the hands of the employees or outsiders of the Organization.

Importance Of Security Testing?

• Security testing is to identify the threats in the system and measure its potential vulnerabilities, so the system does not stop functioning or is exploited.
• It also helps in detecting all possible security risks in the system and help developers in fixing these problems through coding.
• The prime objective of security testing is to find out how unprotected a system may be and to ascertain whether its data and resources are protected from potential intruders.

Types of Security Testing

• Vulnerability Testing: The automated computer program to proactively recognize security vulnerabilities of computing systems in a network to determine where a system can be misused and/or threatened. It is generally done through various vulnerability scanning software. Ex: OpenVas, Nessus, ZAP, Vega, and ISS.
  
• Security Scanning: This is a program that interfaces with a web application through the web front-end to recognize potential security vulnerabilities in the web application, OS and Networks.
  
• Penetration Testing: A penetration test is an attack on a computer system to find security loopholes, potentially gaining access to its functionality and data. It is the most effective way to practically find out potential loopholes in the application.
  
• Risk Assessment: This is a process of evaluating and deciding on the risk involved with the type of loss and the possibility of vulnerability occurrence. This is decided within the organization by various interviews, discussions, and analyses.
  
• Security Auditing: Security Auditing involves a hands-on internal review of Operating Systems and Applications, often via line-by-line inspection of the code. A security audit is a systematic evaluation of the security of a company's information system.
  
• Posture Assessment: It combines Security Scanning, Ethical Hacking and Risk Assessments to confirm an overall Security Posture of the organization.
  
• Ethical Hacking: Ethical Hacking includes the number of penetration tests over the extensive network on the system under test. It is administered by ethical hackers to find possible problems in the system.

Security Testing Tools

Security Testing Techniques

• Access to the Application:

• Authentication: Some of the authentication tests include a test for password quality rules, test for default logins, test for password recovery, test captcha, test for logout functionality, test for password change, test for security question/answer, etc.
  
• Authorization: Some of the authorization tests include a test for path traversal, test for missing authorization, test for horizontal access control problems, etc.
  
• Data Protection: 

• Data Manipulation: In data manipulation, a hacker changes data used by a website to gain some advantage or to embarrass the website’s owners. Hackers will often gain access to HTML pages and change them to be satirical or offensive. Tools: Fidler, Charles Proxy, Web Sniffer, Burp Suite
  
• URL Manipulation: URL manipulation is the process of manipulating the website URL query strings & capture of important information by hackers. This happens when the application uses the HTTP GET method to pass information between the client and the server.
  
• File Uploads: A malicious user can upload a virus or executable file and using  The file size should also be checked so that users do not upload large files that would eat up the server space.

• Command Execution

• SQL Injection: SQL Injection composes illegal SQL statements on a web site application from user-supplied input.
  
• Buffer Overflow: Buffer Overflow happens when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold.

• Session Management: A web session is a series of an HTTP request and response transactions linked with the same user. The session management tests check how session management is handled in the web app. You can test for session expiry after particular idle time, session termination after maximum lifetime, session termination after log out, check for session cookie scope and duration, testing if a single user can have multiple simultaneous sessions, etc.

Final Thoughts

 Security threats are a persistent concern that can only be dealt with consistent monitoring and a dynamic testing strategy. Most of the security testing tools are focused on Interactive Application Security Testing (IAST) or Dynamic Application Security Testing (DAST), which enable the organizations to integrate security testing in their DevOps cycle right at the start. With solutions-oriented, enterprise web application security testing gaining traction, the focus is shifting toward developing a centralized library containing common solutions for issues such as encryption, authentication, and cross-scripting.