Strategies for Security Testing

Online applications are becoming more and more sophisticated as the world gets more inter-networked. Enterprises now rely heavily on web applications for running their business and increasing revenue. However, as the sophistication of the application increases, we are also faced with more sophisticated vulnerabilities and application attacks designed to compromise the ability of an organization to conduct business. Application architects, designers, and developers are now focused on creating more secure application architectures and on designing and writing secure code. In order to make an application vulnerability-resistant, it is essential to have a strong strategy for security testing.

Where to begin Security Testing?
Embedding security testing in the development process is essential for revealing application layer security flaws. Thus, security testing must start right from the requirement gathering phase to understand the security requirements of the application. The end goal of security testing is to identify if an application is vulnerable to attacks, if the information system protects the data while maintaining functionality, any potential of information leakage, and to assess how the application behaves when faced with a malicious attack.

Security testing is also an aspect of functional testing since there are some basic security tests that are a part of functional testing. But security testing needs to be planned and executed separately. Unlike functional testing that validates what the testers know should be true, security testing focuses on the unknown elements and tests the infinite ways that can application can be broken.

Types of Security Testing:
To develop a secure application, security testers need to conduct the following tests:

1. Vulnerability Scanning:
   Vulnerability scanning tests the entire system under test to detect system vulnerabilities, loopholes, and suspicious vulnerable signatures. This scan detects and classifies the system weaknesses and also predicts the effectiveness of the countermeasures that have been taken.
2. Penetration Testing:
   A penetration test, also called a pen test, is a simulated test that mimics an attack by a hacker on the system that is being tested. This test entails gathering information about the system and identifying entry points into the application and attempting a break-in to determine the security weakness of the application. This test is like a \'white hat attack\'. The testing includes targeted testing where the IT team and the security testers work together, external testing that tests the externally visible entry points such as servers, devices, domain names etc., internal testing that is conducted behind a firewall by an authorized user, and blind and double blind testing to check how the application behaves in the event of a real attack.
3. Security Risk Assessment:
   This testing involves the assessment of the risk of the security system by reviewing and analyzing potential risks. These risks are then classified into high, medium and low categories based on their severity level. Defining the right mitigation strategies based on the security posture of the application then follows. Security audits to check for service access points, inter-network, and intra-network access, and data protection is conducted at this level.
4. Ethical Hacking:
   Ethical hacking uses a classified specialist to enter the system mimicking the manner of actual hackers. The application is attacked from within to expose security flaws and vulnerabilities, and to identify potential threats that malicious hackers might take advantage of.
5. Security Scanning:
   To enhance the scope of security testing, testers should conduct security scans to evaluate network weakness. Each scan sends malicious requests to the system and testers must check for behavior that could indicate a security vulnerability. SQL Injection, XPath Injection, XML Bomb, Malicious Attachment, Invalid Types, Malformed XML, Cross Site Scripting etc. are some of the scans that need to be run to check for vulnerabilities which are then studied at length, analyzed and then fixed.
6. Access Control Testing:
   Access Control testing ensures that the application under testing can only be accessed by the authorized and legitimate users. The objective of this test is to assess the differentiating policy of the software components and ensure that the application implementation conforms to the security policies and protects the system from unauthorized users.

Having a security testing plan that functions in alignment with the speed of development becomes essential. The stakeholders can then derive actionable insights from the conducted tests. They achieve a comprehensive vulnerability assessment and ensure that even the most minor chink is corrected at the earliest. By proactively conducting security testing across the software development lifecycle, organizations can ensure that unforeseen, intentional and unintentional actions do not stall the application at any stage.

Keep an eye out for our future blog where we detail how security testing can be included in each stage of the development cycle.