Security Testing in Software Development Lify Cycle.

Security Testing ensures the confidentiality of the data. It can be started right from the requirement gathering phase of the Software Development Life Cycle. This can verify the fact that any intentional or unintentional actions are not able to stop or delay the system. The complexity of security testing is different in different phases. 

1. Requirement Gathering:In this phase, we need to determine the level of security that the system may require while we assess the requirements. The level of security can vary through government level, bank level, e-commerce level, simple information level confidentiality, etc. Another consideration is the effort that can be invested with respect to security testing.
2. Design Phase: Here, a detailed plan for Security testing needs to be created. This involves listing of the testing tools, manual approaches and the list of vulnerabilities that will be covered.

The different types of vulnerabilities can be defined as 

-      Data confidentiality

-      Authentication

-      Authorization

-      Integrity

-      Availability

-      Non-repudiation

The different types of techniques that can be applied are:

-      SQL Command Injection

-      Cross Site Scripting

-      Session Management and broken authentication

-      Insecure direct object references

-      Exposure of sensitive data

-      Security misconfiguration

-      Function level access control

-      Cross Site Request Forgery

-      Invalid redirects

-      Using vulnerable components.

- Development Phase: Here tools for static analysis can be used for security testing. This tool helps in identifying the security loop holes based on patterns and rules. Testing in this phase is the most recommended, as it involves unit level testing. Here, each code block is tested for potential bugs. These bugs if left unchecked, result in a bigger error at the later stages. Examples of such bugs 

-      Exception Handling

-      Ignored Return Values

-      Buffer Overruns

-      Complicated Functions

- Integration Phase: As the code blocks are integrated one by one to form the whole system, integration testing is performed. This is also known as black box testing. These tests are performed to eliminate security vulnerabilities before deployment. These uncovers errors that were missed out or were nonexistent in the unit level testing. It also detects configuration errors, potential security inconsistencies with third party applications and the overall system. 

- System Testing Phase: Here vulnerability scanners are used extensively. They have a predefined set of security rules, adhering to which they crawl through the entire application finally creating a comprehensive report on the system vulnerabilities. It clearly defines the cause, severity and the solution for each case.  However, the scanner should be used with a manual check as it may generate many false positives due to its pre-defined set of rules and no knowledge of the business logic.

- Deployment Phase: Here, PenetrationTesting is performed where a hacking attack is simulated on the system. This is performed to uncover all the remaining security threats. Performing penetration tests avoid network costs as well as regulatory requirements. 

- Support/Maintenance Phase: All the above testing were pre-production testing. After deployment, post production testing need to be performed. This can be done more efficiently by using a Software Security Assurance Program.

Conclusion:

Security Testing is not something which can/needs to be only performed in the production environment. It should be performed through every phase of the SDLC. As it covers all the security issues right from initiation, it also reduces the cost, time and effort for future fixings.

The importance of Security Testing of Web Applications

With the increasing complexities of online business, we now communicate with multiple web applications,  in our daily life. We pay bills electronically, shop online for easy and comforting shopping experience, store payment credentials online for easy access and opt for internet banking to save time. Now, that almost all information is stored in a digital form, in one way or the other. Though it is the modern method of interacting, it has elevated the level of threat. Unauthorized access to these private information and confidential transactions can lead to catastrophic outcomes. This necessitates thorough security testing.

In order to carry out a full-scale security testing of a web application, it is important to know and understand how the online protocols work and communicate with each other. Additionally,  if the tester knows the scripting language of the application, it's an added advantage. 

Security Testing can be categorized into two types - Static Testing and Dynamic Testing. There two ways to carry out security testing - Manual and Automated.

Dynamic Testing tests on the running instance of the application. It sends requests to the application and reviews the response to find out any indication of potential security issue. As this type of testing is based on sending requests and analyzing responses, the conclusion is mainly based on guesswork. It is a kind of black box testing where the tester has no knowledge of the internal structure of the application. Hence, it is possible that some responses may not be an obvious security threat, and some deviations in responses may go unnoticed and unreported.

Dynamic Testing can be performed either manually or by using automatedtesting tools. Automated tools are very efficient in detecting possibilities of SQL Injection and Cross -Site - Scripting (XSS). Configuration problems with the server and operating system are also tested. Thus, they identify most of the technical vulnerabilities of the web application. However, they are limited in a way that they have no knowledge of the business logic of the code they are testing. Logical flaws are equally threatening as technical flaws.

Manual Testing are performed using Web proxy tools. Manual testing looks for data leakage, denial of service, unauthorized access and proper logical response to a request of predefined parameter values.

Static Analysis reviews the internal assets of the application such as the source code, configuration files and the business logic. It is a more thorough process of testing as it has access to the internal files of the application. It can also be referred as a white box testing approach. This reduces the possibilities of false reporting and missed indications. However, the static approach fails to detect the security issues based on technical configurations. Static analysis can also be performed manually or through automated tools.

 Automated static tests run tests against large source code bases consistently. They execute a set of rules, but without any understanding the context of the web application. Thus, static automated testing has the same limitation as per dynamic testing.

Conclusion

Hence, it can be said that efficient security assessment of web applications can be carried out by following a combination of dynamic or static and manual or automated techniques. It also depends on the resources available, access provided and the skills available. Different organizations have different rules and accordingly the best security testing strategy is put into practice.

Performing Security Testing for Mobile and Web Applications.

In today’s connected world, we rely more and more on web and mobile applications to store and retrieve important information, security of these applications needs to be ensured. Security testing identifies potential threats and vulnerabilities of the application system.

The different kinds of web and mobile security checking are as follows:

1. Vulnerability Assessment and Penetration Checking: Vulnerability assessment process discovers different weaknesses in the system that makes threats possible, but it does not categorize them as per their threat potential.  Penetration testing exploits these vulnerabilities and determines the severity of each. Both these tests together provide a detailed picture of the system’s flaws.
2. Security Scanning and auditing: This helps to identify the network and system problems.
3. Risk Assessment: This helps to identify potential hazards and its implications on occurrence. 
4. Ethical Hacking or white hat hacking is another process to expose the system loopholes. This hacking is unlike the malicious intentions and is carried out within the organization.
5. Command Injections: Here software hackers execute arbitrary commands into an input mechanism basically designed to pass user supplied data.
6. Data Security: There is always a threat to the confidential data being stolen. Portability of the device is an additional hazard in this case. Hence unlike web data security, for mobiles it is a different testing process. Mobile based data protection and data security help to identify potential data exfiltration threats.
7. Session Management: For web applications the authenticated state of a user is maintained through the use of cookies which may be HTTP cookies, Flash Cookies or Evercookie. In mobiles, apart from HTTP and browser connections, apps communicate with the back end servers as well. Hence, all cookie based authentications do not hold true for mobile users. With different mobile platforms in Andriod, ioS and Windows, this difference becomes more complicated for different configurations required for VPN.
8. Unauthorized access: In a web application, an administrator is able to authorize the access to users. In mobile applications this authorization is carried out in both  client side and server side. Also, when apps are installed they are required to be granted a range of user permissions which is not always a preferred choice.

Security Testing need to be carried out in parallel with System Development Life Cycle(SDLC), later implementations result in increased effort, time and cost. 

The testing phases associated with each phase of SDLC are as follows:

Development Phase	Testing
Requirement Specification	Security Analysis
Architecture Planning	Risk Analysis
Design	Security Test Plan
Coding	White Box Testing
Integration	Integration Testing Black Box Testing System Testing
Installation	Penetration Testing Vulnerability Scanning
Support	Impact Analysis

 Below are the mobile testing processes:

-      Preparation

-      Gather Intelligence

-      Threat Modelling

-      Vulnerability Analysis

-      Vulnerability Assessment

-      Develop Countermeasures

When we compare both, we observe that basic testing phases are the same for both, security testing of mobileapps extend a bit further than web applications due to:

-      Portability 

-      Always online and geographically traceable

-      Device Properties

-      More focus on app functionality than security

Conclusion:

In web applications, the security loopholes are associated with SQL injection, redirects and includes for remote files. Here, attackers take a black box approach. In mobile application hacking, more of a reverse engineering skills are put through as the attackers already have access to the codes. Overall Security Testing is most important testing for the success of web or mobile applications. Overlooking Security testing can become the major reason for performance pitfalls and failure of fascinating web and mobile applications. 

Ensuring Software Reliability via Software Security testing.

Security and Reliability are two qualitative concepts of the software that have grown into two different domains of research and analysis. We may consider a software to be reliable when is has been ensured security. We can say that software is reliable only when it is secure. Security testing checks the software vulnerability to external attacks. The main security concepts covered by security testing are confidentiality, integrity, authentication, authorization and non-repudiation.

Let us view some instances when software failures led to fierce consequences.

·         An incoming missile was identified as ‘friendly’ by a radar system. This led to the sinking of The British destroyer, Sheffield.

·         A small unnoticeable error eventually led to a loss of 28 lives when during Gulf War, a precision error of missing 0.000000095 second, in every one-tenth of a second, over 100 hours, led to the failure of the Patriot missile intercept the Scud missile.

·         Heartbleed, a bug affected web servers making user passwords vulnerable to theft.

·         Target announced a breach of its point of sale terminals.

A once perfectly working software may also show errors if the supporting environment changes. With processors and software pervading our world, reliability and security of software has now become a matter of life and death. Such statistics and considerations have focused our attention on the importance of software security testing for ensuring reliable interaction.

The Approach :

Software and software systems are deployed in almost every technical system in most of the domains like science, commerce and communication industries. These implementations can become reliable only when tested secure. As the innate qualities of any software is its security.  It is its ability to deal with the vulnerabilities of the system against external forces.  Software reliability is the ability of the software for a failure free operation in a specified period of time in a specified system, considering that all the other components of the system are fault free. Reliability of the software keeps changing with time along with bug detection and fixes, making software security testing a continuous process.

The cyber world has now become more and more vulnerable to attacks. Security testing must be carried out throughout the lifecycle of the project. Software developers work out distinct set of improvements for the software – one that increases reliability and the other that establishes security.  For software reliability, the bugs that hinder the error-free functioning of the system are fixed. This requires to be done both in the designing and the testing phase. Reliability of a system can be tested by releasing the beta version of the software.

For ensuring security, the developers look for flaws at the operating system level which may lead to possible breaches. These may be related to heap overflow, buffer over flow, bad code etc. The main Security testing issues are detection of intrusion, authorization, authentication, data integrity and confidentiality, patches, viruses and firewalls. Security Testing needs to be embedded into every phase of System Development Life Cycle from software requirements to its release.

Conclusion:

A risk based approach must be used to enable the software security completely. By creating tests based on risks, those areas of code can be easily identified where an attack can succeed. This assures a higher level of security which makes the software more reliable. Implementing continuous Software Security testing  can only ensure reliable software with changing trends of technology..