What are the complexities involved in Security testing project for an online retail firm? Do you think the majority of the issues are related to payment and checkout process or do you find other vulnerable areas as well?

It is good thing to create a flexible and fast environment for customers who like quick transactions on retail websites. Thinking of this as a time saving feature customers are taking a major risk of saving bank cards' details over the internet. Looking at the current phase of change in retail area and rapid growth of e-commerce website, we can say that we are very near to the future of "Neighborhood without shops". However to get this thing to reality and to build an ecosystem of online retail. We definitely have to create trust among others to switch to online shopping.

The main problem is customer's card details getting saved on servers, e-commerce websites involve in saving card details for future transactions that is a major risk. In today's world we cannot trust any brand but still we are bound to do that and we stick to a particular website on buying stuff through it. We are no stranger to threats related to internet transaction and we know that hackers sit down to break the code to get the valuable information. To make the confidentiality with data integrity is a main thing to be considered in e-commerce products. There are chances that level of encryption is not that up to par with the standard security models. What if the user while creating a new account on e-commerce websites the login page is hacked and the accounts are duplicated by the hacker, Also to the check the session time-outs on maximum and minimum load because there can be chances that when sessions are not expired one can easily login with the same user details available on the website and then can modify personal information like delivery address, email address etc. An e-commerce website should not be just secure to payment threats but also for personal information as well. It is us, the QA who have to make sure that there are no flaws in the system's valid encryption and even if there are some available threats then to reveal them.

What if that particular brand's server gets hit by a major security threat on vulnerable areas? What if while deploying new feature the old application's security gets hampered by incorrect logic and it becomes vulnerable and prone to attacks? User's data is always in jeopardy. More over it is not a just the server it is also the browser which saves the data at the time of transaction e.g. Firefox is always prone to these kind of threats and saves the important content without user's consent or their knowledge. So we have to think of applications which can stop the browsers to do that. Moreover at the time of checkout there can be hackers sitting in taking pass-codes from the users which is the major problem and users get affected by the theft of information. As the application gets complex more stringent rules and testing should be applied on the application so that we as a customer can be at a safe point. The major threat what we see right now is indulgence of mobile app world to it. Although we download the apps from trusted Application market. However there can be threat of losing personal data. Most of the applications, there are chances that there are spyware, adware or any other malicious code can fetch data out of the mobile phones like saved passwords, phone numbers etc. Trust plays a vital role in any business so we can only do that by performing security testing on the applications.