Security Testing Techniques

Discuss the various security testing techniques required to test desktop and web Applications security.

We are at present living in the age of technology and the internet has matured to new heights during the decade.
All the work, whether it be purchasing merchandise like software, books etc or booking a railway or flight ticket is now generally done via the internet. This shows the amount of security which is there and is required for keeping the applications safe from unwanted loss or modification.Security means restricting the unauthorized access and granting private data access to authorized requests.

There are certain areas to test to make an application secure and there are several techniques to test it:

1. Data security:
The data of any application is one of the most important thing to be secured, so users with proper access should be granted proper permissions and proper encryption techniques should be there so that the data is secured properly.

2. Mechanisms to contain Brute-Force Attack:
Brute-Force Attack is a type of attack where the software tries to match the password by applying matching passwords so web servers restrict that by restricting the entry of wrong passwords to a specific number of times.

3. Accessing the data which a user is entitled to:
For example a specific type of user is concerned to a specific type of data and (s)he should be entitled to access that data, for that mechanisms like multilevel password protection is there.

4. Data Protection:
All the important data in Database must be encrypted. Tester should query database for passwords, credit card numbers & bank information and make sure that they are encrypted. S/he should also confirm that private data which is transmitted over internet is in encrypted format and successfully gets decrypted when it reach its destination.

5.Brute-Force Attack:
In this, attacker tries to find the password of a UserID by attempting to login again and again with different combinations of password using some software. Tester should confirm security by making sure that application blocks the access to account for some time in case multiple invalid login attempts has been made.

6. XSS (cross site scripting) and SQL Injection:
In this, attacker manipulate the websites by using malicious scripts. Tester should confirm security against these kind of attacks by making sure that input fields length are small enough so that attacker cannot input any script in it. Tester should also verify that proper validation are applied to fields which require long inputs i.e. user should not be allowed to use special characters like ‘<’ in these fields.

7. Access to Application:
Access to either desktop or web applications should be grated to only authorize requests. To test this, tester can create several user accounts with single and multiple roles and then can use these accounts to test the application. S/he should make sure that every account is only allowed to access its own module and access to other modules is prohibited.

http://www.qainfotech.com/index.html

Security Testing Techniques

Discuss the various security testing techniques required to test desktop and web Applications security. “Security testing techniques include a lot many ways to check whether the system is protected from any external threats. One of the techniques is Brute Force attack, the idea behind this technique to prevent the access for a user who attempts to break the password by guessing it. The system tries to match a valid id with a password by repetitive logins. To protect the system against such a threat, account blocking is the one way in which the account is locked for a duration (30 minutes to 24 hours) after a specific number of incorrect attempts. It is very easy to test this type of the security of the application; the tester needs to attempt to login again and again with invalid user Ids or passwords. On the other hand sometimes the hackers use the malicious scripts to manipulate the websites, which is called the SQL injection. To check whether the site is secure or not, a tester need to check the all the input fields to be limited in length and should not accept any script or tag inputs. The input fields should accept some limited special characters.” Software industry is well recognized in this century. Cyber world has become more advanced and dominating in every form of business. Various security techniques are evolved for testing desktop and web applications.Some of them are following:- 1) Access to Application: For both web and desktop applications, security to access is achieved through 'Roles and Management'. For checking this scrutinized testing of entire roles and responsibility is required. 2) Data Protection: Data protection is very important perspective in security. Entire data should be protected through encryption. Tester should use query to inspect the passwords of users, business critical data. 3) SQL Injection and XSS: In this despiteful script is used by hackers to change application. Tester should ensure that utmost lengths of inputs are prescribed. 4) Service Access Points: In today’s world, every business is collaborative process. This type of phenomena is also applicable for application sites. For mutual collaboration, access points are defined for each other. For security cases, access can be locked for redundant elements. In testing point of view, the inter and intra -network access should only be granted to trusted applications. http://www.qainfotech.com/index.html