Are testers as good as hackers ?

An open question for all the experts, are testers as good as hackers in finding security holes in companies, web based applications? If not then why companies hire security testing professionals instead of hackers?

Waiting for your opinion.

Testers are better than hackers in my opinion. Hackers always love to break systems, discover imperfections of an application while Testers care about the quality of an application and try to make the customer's experience better with the application.  Testing professionals are better than hackers in finding security holes in companies, web based applications because in security testing we need to focus on SQL injection problems, UI design, performance of an application under heavy load and recognizing logical errors. For all this company needs a professionally trained person, who has the knowledge of testing technology and principles, performance tools. That’s pretty dumb if companies hire hackers instead of security professionals. While the hacker may have proven to be an expert in attacking systems, this can’t be interpreted into being an expert in protecting the systems as well. It’s hard to guard against all kinds of attacks than to perform a single attack on illegally accessed system. A hacker is what takes down security in most cases and exposes information. It all comes down to a question of trust. Giving a person access to your network - especially the kind of access that’s required to analyze your security, is like to giving someone access to your bank accounts. It’s a position that carries a great deal of responsibility. So I don't see why any company would want a hacker to help them with security.

Give your expert comments on how security testing takes a different mindset than functional QA testing?

Give your expert comments on how security testing takes a different mindset than functional QA testing?

Security testing in many ways is similar to functional testing but the main difference is of mindset. In case of functional testing we focus that the features should work for end user that means the application does what they expect and does not hinder them in completing their tasks. Where as in case of security testing the end user is like an attacker who would try to break the application is all possible ways. So our focus should be more on proving that a specific attack scenario does not succeed. Security testing when done properly goes deeper and even beyond the functional testing. Security testing aims to eliminate the aspects of systems that do not relate to application functionality but to the reliability, confidentiality and availability of applications A functional QA engineer can typically think up a variety of methods to verify the functionality of a feature or component. The attention of functional testing is much more focused on how to enable the customers to perform their tasks in the easiest and most convenient way possible while providing enough checks and safety measures so that user can't cause unintentional harm too easily. But a security tester needs to go deep. He has to think nasty, considering the cases that shouldn’t be allowed to a typical user and user’s can perform only those tasks they are authorized to perform. By testing the security of your application and being prepared, software hackers will be more likely to focus on applications that have not properly tested.

security testing

To ensure that an information system protects data and maintain its functionality, security testing is required. Security Testing can be broadly categorized into six security concepts ie Confidentiality, Integrity, Authentication, Availability, Authorization and Non-repudiation. These are the following characteristics of Security Testing:

·         It helps to keep the information confidential between the two parties.

·         IT ensures that given Information is correct.

·          It assures that a computer program is trusted one.

·         It helps in access control.

·         It provides the availability of the information.

·         It provides guarantee of that a sender has sent the message and recipient has received it, both of them cannot deny in future.

For more Details Log on to: http://securitytestingservices.blogspot.in/