Security testing

The security testing is performed to check whether there is any information leakage in the sense by encrypting the application or using wide range of software’s and hardware's and firewall etc.

Before planning for Security Testing, you will need to think about the following parameters:

• Authentication - Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism. Basically, it allows a receiver to have confidence that information it receives originated from a specific known source.
• Authorization - Determining that a requester is allowed to receive a service or perform an operation.
• Confidentiality - A security measure which protects the disclosure of data or information to parties other than the intended.
• Integrity – Whether the intended receiver receives the information or data which is not altered in transmission.
• Non-repudiation - Interchange of authentication information with some form of provable time stamp e.g. with session id etc.

Various types of security testing involve:

Physical security, lock doors, dont leave laptops, usb drives etc, locks on servers, dont laptop store in a car

Protection from internet based attacks
check website for, cross site scripting vunerabilites, sql injections, open ports, weak port 21 25 passwords or vunerabilities. weak java code that can be read and broken. check online for threats to whatever server OS you are on. loads more things tho…
look into google hacking and try it against yourself

if you have wireless network, use WPA encryption 256, hide SSID, limit access to certain times, limit access by mac address if possible or ip range.

If you have windows servers that accept RDP use strong password and limit access to ip or ip ranges.
Testing will look at antivirus in place, internet browser vunerabilites etc


Various Security Testing techniques which are in practice.

Vulnerability / Risk Assessment is the first step in planning and conducting Security Testing. This process defines, identifies, and classifies the security vulnerabilities in an application or system. In addition, vulnerability analysis can also help forecast the effectiveness of proposed countermeasures and evaluate their actual effectiveness after they are put into use.

Vulnerability / Risk Assessment consist of following steps:

1.Assigning relative levels of importance to the resources based on the criticality and complexity (interactions / content).
2.Identifying potential threats to each resource.
3.Prioritizing potential problems (high risk exposure to be addressed first).
4.Defining and implementing ways to minimize the consequences if an attack occurs.

Usage of ethical hacking method to assess vulnerabilities, security experts deliberately probes a network or system to discover its weaknesses. This process provides guidelines for the development of countermeasures to prevent a genuine attack. Quantitative risk analysis helps to numerically determine the probabilities of various adverse events and the likely extent of the losses if a particular event takes place.

There is no better way of securing applications (eventually the system) than embedding the security while it’s taking shape (SDLC). Having an application security life cycle in place can reduce the cost of eradicating vulnerabilities and make efforts more effective. Move security assessment phase into the development phase. Many have found that doing so actually reduces overall application development times.Repeat the security assessment process when the business logic in the application changes. This is necessary to evaluate the impacts of any changes on overall application security.

Penetration Testing is the practice of testing a computer system, network or Web application to find vulnerabilities that an attacker could exploit. The main objective of penetration testing is to determine security weaknesses. There are several ways of conducting Penetration testing which includes internal and external etc.

Security testing is a vital safety measure one can’t ignore today. New techniques /tools are invented every now and then, some are more sophisticated and novel, the combination has to be chosen carefully based on the nature of application / system.