Security Testing

Security testing is done to identify the vulnerability of a software application. It is done to prevent malicious attacks from a third party. The purpose of the security test is to identify the weakness and loopholes of the software system to avoid the loss of information, revenue, and confidential data.
The major goal of security testing will identify the potential threats and measure the risk in a software application. So, the developer team can fix the security risk in the system through coding.
How to do Security Testing
We have to test the software each phase or after deployment so, that the resources and cost will be less. It is necessary to include security testing in the SDLC life cycle in each phase.
SDLC Phases Security Processes
Requirements: Security analysis for requirements and check misuse cases
Design: Development of Test Plan including security tests. Security risks analysis for designing.
Coding and Unit Testing: Static and Dynamic Testing and Security White Box Testing
Integration Testing: Black Box Testing
System Testing: Black Box Testing and Vulnerability scanning
Implementation: Penetration Testing, Vulnerability Scanning
Support: Impact analysis of Patches
Sample Test scenarios to give you a glimpse of security test cases –
1. A password should be in an encrypted format with a combination of alphanumeric and special characters.
2. The Application or System should not allow unauthorized users.
3. Do check cookies and session time for application.
4. For financial websites, the back button on the browser should not work.
The Major Focus Areas in Security Testing are as follows:
• Network Security
• System Software Security
• Client-side Application Security
• Server-side Application Security
List of Top 8 Security Testing Techniques
1) Access to Application: This can also be understood as authentication and authorization testing means we need to test ‘Who are you’ and ‘what you can do’ for unique users.
2) Data Protection: In the data security, a user can view or utilize only the data which he is supposed to use. This is also ensured by roles and rights
3) Brute-Force attack: The software attempts to guess the associated password by trying to log in again and again.
4) SQL injection and XSS (Cross-site scripting): The malicious script is used by hackers in order to manipulate a website.
5) Service Access Points (Sealed and Secure open): These access points can be sealed for unwanted applications or people.
6) Session Management: The session management tests check how session management is handled in the web app.
7) Error Handling: To check for error codes and Stack traces.
8) Specific Risky Functionalities: The main two functionalities are payments and file uploads.

Security Testing Roles
• Hackers – They will try to access a computer system or network without authorization.
• Crackers – They will try to break into the systems to steal or destroy data.
• Ethical Hacker – They will perform most of the breaking activities but with permission from the owner.
• Script Kiddies or packet monkeys – These are Inexperienced Hackers with programming language skills.