How to prepare for Security Testing

 

The advancements in digital technologies are matched by an increase in the incidences of cyber security. Threats from hackers are all-pervasive and it appears they can wreak havoc at their time and place of choosing. However, there are two sides to a coin. First, hackers seem to be one step ahead of software developers and have the technical wherewithal to break into the software architecture at will. On the other hand, most software applications are vulnerable to hacking as they have inadequate defences and do not mandatorily follow security testing in the SDLC. The result of not performing application security testing by many enterprises shows in the form of rising incidences of data breach.

According to statistics, around 7 million data records are compromised each day taking the annual figure to 2.55 billion (Source: Varonis). Also, the world economy is going to cough up around $6 trillion annually by 2021 on account of cybercrime damages (Source: Cybersecurity Ventures.) These statistics are alarming enough for every stakeholder to strengthen the cybersecurity measures. No one can hide behind the thought that ‘we are too insignificant for the hackers to attack us’ anymore. So, in the ultimate analysis, it is finally a choice between creating and implementing an application security testing strategy or waiting for the hackers to play havoc. 

Why security testing?

It is a type of testing in the SDLC where testers aim at identifying flaws or vulnerabilities in the architecture of a software application. Security testing ensures the application remains protected from cyber-attacks and continues to perform the intended functionalities. The six basic elements to be covered by the security testing services include confidentiality, integrity, availability, authentication, authorization, resilience, and non-repudiation.

With an increase in online transactions using web portals and mobile applications, cyber intruders are on the lookout for vulnerabilities in software. Thus, a dynamic application security testing ensures potential vulnerabilities are identified and plugged before the application reaches the end-users. Further, any software security testing exercise can pre-empt the following possibilities:

• Losing the trust of customers
• Downtime and latency faced by the application or system resulting in not meeting the delivery schedules
• Expenses on restoring services including taking backups etc
• Additional cost incurred in making the application secure against future attacks
• Legal suits filed by regulatory agencies, clients, or customers for not upholding adequate security measures

Types of security threats

There are many types of cyber security threats that hackers use to exploit the vulnerabilities in a web or mobile application.

SQL Injection: Malicious SQL statements are entered into an input field to get critical information from the database.

Privilege Elevation: Hackers use an account on the application to upgrade their privileges to a higher level.

Denial of Service (DoS): The hacker manipulates the system, application, or network to deny the availability of resources to legitimate users.

URL Manipulation: The process involves the manipulation of the URL query strings to capture critical information. It takes place when the application passes information between the client and server by using the HTTP GET method.

Cross-Site Scripting (XSS): This type of vulnerability allows hackers to inject client-side script into pages to trick users into clicking on the URL.

Devising a security testing strategy

To plan, prepare, and implement dynamic application security testing in the SDLC, the following approach can be followed.

Understanding the security architecture: Begin with understanding the IT architecture, business requirements, threats, and security objectives of the organization. Every factor or requirement needed to ensure PCI compliance should be considered during the planning phase.

Analysis of security architecture: Analyze the application’s security requirements including the vulnerabilities.

Classification of testing: Get information about the software application and network in terms of their hardware configuration, operating systems, and technology used. Thereafter, classify the security risks and vulnerabilities based on the aforementioned elements.

Threat modelling: Prepare a threat profile of the application based on the information collected for classification (mentioned above.)

Planning for the test: After identifying the vulnerabilities and security threats, prepare a test plan and traceability matrix to address them.

Selecting a tool: Test automation becomes critical to identify glitches or flaws, which otherwise cannot be done manually. To execute the test cases quickly, a reliable testing tool should be chosen.

Test case execution: Execute the test cases including the regression ones to identify defects, quickly, accurately, and consistently.

Documentation: Study the test reports generated by the test automation tool to understand the vulnerabilities, risks, open issues, and threats.

Conclusion

Security testing has become a critical requirement in the DevSecOps-led model of software development. It ensures the identification (and subsequent fixing) of vulnerabilities or security-related risks in any software application. It also enforces software applications’ adherence to established security protocols.

Original Article Source:
https://devdojo.com/hemanthkumar989/the-main-elements-of-security-testing

What are the best testing tools for 2020?

Digitalization, although a blessing in every sense of the word, can have its basket of thorns as well. This refers to the hacking activities using measures like phishing or introducing elements like ransomware, viruses, trojans, and malware. Globally, security breaches have caused an annual loss of $20.38 million in 2019 (Source: Statista.com). Also, cybercrime has led to a loss of 0.80% of the world’s GDP, which sums up to around $2.1 trillion in 2019 alone (Source: Cybriant.com).

With a greater number of enterprises and entities clambering onto the digital bandwagon, security considerations have taken a center stage. And since new technologies like AI/ML, IoT, and Big Data, are increasingly making inroads into our day-to-day lives, the risks associated with cybercrime are growing as well. Further, the use of web and mobile applications in transacting financial data has put the entire digital paraphernalia exposed to security breaches. The inherent vulnerabilities present in such applications can be exploited by cybercriminals to siphon off critical data including money.

To stem the rot and preempt adverse consequences of cybercrime, such as losing customer trust and brand reputation, security testing should be made mandatory. Besides executing application security testing, every software should be made compliant with global security protocols and regulations. These include ISO/IEC 27001 & 27002, RFC 2196, CISQ, NIST, ANSI/ISA, PCI, and GDPR.

Thus, in the Agile-DevSecOps driven software development cycle, security testing entails identifying and mitigating the vulnerabilities in a system. These may include SQL injection, Cross-Site Scripting (XSS), broken authentication, security misconfiguration, session management, Cross-Site Request Forgery (CSRF) or failure to restrict URL access, among others. No wonder, penetration testing is accorded high priority when it comes to securing an application. So, to make the software foolproof against malicious codes or hackers, let us find out the best security testing tools for 2020.

What are the best security testing tools for 2020?

Any application security testing methodology shall entail the conduct of functional testing. This way, many vulnerabilities and security issues can be identified, which if not addressed in time can lead to hacking. The tool needed to conduct such testing can be both open-source and paid. Let us discuss them in detail.

·         Nessus: Used for vulnerability assessment and penetrating testing, this remote security scanning tool has been developed by Tenable Inc. While testing the software, especially on Windows and Unix systems, the tool raises an alert if it identifies any vulnerability. Initially available for free, Nessus is now a paid tool. Even though it costs around $2,190 per year, it remains one of the popular and highly effective scanners to check vulnerabilities. It employs a simple language aka Nessus Attack Scripting Language (NASL) to identify potential attacks and threats.

·         Burp Suite: When it comes to web application security testing, Burp Suite remains hugely popular. Developed by PortSwigger Web Security and written in Java, it offers an integrated penetrating testing platform to execute software security testing for web applications. The various tools within its overarching framework cover the entire testing process. These include tasks like mapping & analysis and finding security vulnerabilities.

·         Nmap: Also known as the Network Mapper, this is an open-source tool to conduct security auditing. Additionally, it can detect the live host and open ports on the network. Developed by Gordon Lyon, Nmap does its job of discovering host and services in a network by dispatching packets and analyzing responses. Network administrators use it to identify devices running in the network, discover hosts, and find open ports.

·         Metaspoilt: As one of the popular hacking and penetration testing tools, it can find vulnerabilities in a system easily. Owned by Rapid7, it can gain ingress into remote systems, identify latent security issues, and manage security assessments.

·         AppScan: Now owned by HCL and developed by the Rational Software division of IBM, AppScan is counted among the best security testing tools. As a dynamic analysis testing tool used for web application security testing, AppScan carries out automated scans of web applications.

·         Arachni: As a high-performing open source and modular web application security scanner framework, Arachni executes high-quality security testing. It identifies, classifies, and logs security issues besides uncovering vulnerabilities such as SQL and XSS injections, invalidated redirect, and local and remote file inclusion. Based on the Ruby framework, this modular tool can be instantly deployed and offers support for multiple platforms.

·         Grabber: Designed to scan web applications, personal websites, and forums, this light penetration testing tool is based on Python. With no GUI interface, Grabber can identify a range of vulnerabilities such as cross-site scripting, AJAX and backup files verification, and SQL injection. This portable tool supports JS code analysis and can generate a stats analysis file.

·         Nogotofail: Developed by Google, this testing tool helps to verify the network traffic, detect misconfigurations and TLS/SSL vulnerabilities. The other vulnerabilities detected by Nogotofail are SSL injection, SSL certificate verification issues, and MiTM attacks. The best attributes of this tool include being lightweight and easy to deploy and use. It can be set up as a router, VPN server, or proxy.

·         SQL Map: This free-to-use security testing tool can support a range of SQL injection methodologies. These include Boolean-based blind, out-of-band, stacked queries, error-based, UNION query, and time-based blind. This open-source penetrating testing software detects vulnerabilities in an application by injecting malicious codes. Its robust detection engine helps by automating the process of identifying vulnerabilities related to SQL injections. The tool supports databases such as Oracle, PostgreSQL, and MySQL.

Conclusion

Testing the security of applications or websites has become a critical requirement in the SDLC. This is due to the growing threats from cybercriminals who are adopting every possible means to hoodwink the security protocol or exploit the inherent vulnerabilities in a system. The only insurance against such a growing menace is to make security testing a responsibility for every stakeholder in the SDLC and beyond.