Security Testing (A Complete Guide)

Key Approaches To Application Security Testing – for both web and desktop applications

The Relevance of Security Testing

There is no denying the profound growth that the software industry has undergone in recent years. Nonetheless, we simply cannot overlook the influence of the cyber-world on many businesses across the globe. A web-based ERP system, for instance, has grown from being a marketing collateral to a robust tool that can meet several business needs.

Deep Dive into Security Testing

Online applications, such as platforms for banking, shopping, trading stocks, and managing payroll, are not just used by organizations; they are also marketed as products to customers. This only goes to show how critical security elements are since customers and users place their trust and confidential information on these platforms. Security is just as vital for desktop applications.

However, when dealing with online platforms, there is a heightened need for tightened security measures. If an online system falls short in protecting transactional data, it would lose its credibility, and users might refrain from using it. As such, security is one of the most essential features that must be factored into an application. Below are few examples of security vulnerabilities in an application:

• A student management system is insecure if data from the ‘Exam’ branch can be modified by the admissions department.
• If a data entry operator can generate ‘Reports’, an ERP system is considered insecure.
• An online shopping platform is not secure if customer credit card information is not enciphered.
• A custom-built software is unsecured if actual user passwords are fetched by an SQL query.

What does Security Entail?

“Security encompasses both offering authorized access to safeguarded data and limiting illegal access.”

Security covers two significant areas: securing data and access to that data. Whether an application is web-based or desktop-based, security is paramount in both cases.

The following sections offer a comprehensive view of security aspects to consider in desktop and web-based software applications.

Understanding Desktop and Web Security Testing

A secure desktop application simply does not limit access but also assures an organisation of proper data organization and storage. However, in the case of web applications, there is a more pressing need for safety measures to guarantee both access and data security. Web developers have to work towards making their applications resistant to SQL injections, brute force attacks, and XSS (cross-site scripting). In case a web application offers remote access points, these also need to be well-secured.

Note that brute force attacks are not restricted only to web applications; even desktop software can be susceptible to them.

We hope this introduction has given you adequate context, but let’s proceed to the main topic. I apologize if you initially thought that the article would chiefly be about software security and its pressing concerns. Now, our primary focus will be “Security Testing”.

Key Reading: Testing the Security of Web Applications

Now, let’s examine how software applications incorporate their security features and how these must applied and tested. The emphasis will be on the principle and methodology of security testing as opposed to the aspect of security itself.

---

Preferred Tools for Security Testing

#1) Netsparker

Netsparker is a solution that automates web application security testing. It specializes in thorough scanning and crawling of all varieties of web applications, including HTML5, Web 2.0, and Single Page Applications. It takes advantage of the Proof-Based Scanning Technology and scalable scanning agents to give a complete view for handling multiple assets. Netsparker also extends team and vulnerability management features and can easily integrate with CI/CD platforms like Jenkins, TeamCity, or Bamboo.

---

Top 8 Security Testing Strategies

#1) Accessing the Application/span>

In both desktop and web applications, “Roles and Rights Management” is used for implementing access security. By defining proper roles and rights, secure access can be ensured.

To test this, a comprehensive examination of every role and right should be conducted. A tester should create user accounts with various roles and validate that each role has only access to its assigned modules, screens, forms, and menus. Any discrepancies or unauthorized access should be duly reported.

Testing authentication and authorization is vital for evaluating access security and ensuring proper user identification and authorized operations.

#2) Protective measures for Data

Data security encompasses three aspects: control of data access for users, secure data storage, and protection of data flow within and among applications.

The tester should attempt to retrieve sensitive data like user passwords from the database and ensure they are encrypted. Data transmission should also be encrypted, and its decryption at the destination should be secure. Additionally, tests for vulnerabilities such as weak algorithms, salting, and insecure randomness should be performed.

For web applications, it’s essential to transmit sensitive data over HTTPS instead of HTTP and ensure that server configurations are secure and certificates are valid.

#3) Brute Force Attacks

Brute-force attacks entail the repetitive use of valid user IDs by software tools to guess a password. A basic security layer against such attacks is the suspension of accounts after a specified number of unsuccessful login attempts.

A tester should verify whether a software application suspends accounts after a series of consecutive unsuccessful login attempts using incorrect credentials. If the application successfully locks out accounts, it is deemed secure against brute-force attacks.

#4) SQL Injections and XSS (Cross-Site Scripting)

SQL injection and XSS (cross-site scripting) attacks function similarly, by injecting malevolent scripts to manipulate a website. Precautionary measures include defining smaller field lengths for input fields and validating input to restrict scripts input and prevent HTML tags.

The tester should make certain that the implemented maximum lengths of input fields are adhered to, and script or tag input is not permitted by input fields. The application should filter out script redirects from unknown or dubious applications to thwart XSS attacks.

#5) Service Access Points (Sealed and Securely Opened)

Web applications often interface with other applications and businesses, necessitating defined and available access points. These access points should be securely open and accommodating, catering to a myriad of users.

A tester must confirm that both intra and inter-network access to the application is limited to trusted users, machines, and applications. Both the performance and security of the access points should be verified across various scenarios and real-world transactions.

#6) Managing Sessions

Testing of web session management entails understanding how a web application handles sessions, including session termination, expiry and the scope of cookie use. Various aspects, such as simultaneous sessions, log-out and idle time should be tested to ensure accurate session management.

#7) Handling Errors

Involves testing for error codes and stack traces. Error messages should not disclose critical information that could be exploited by potential attackers. Likewise, stack traces should not offer any valuable details.

#8) Testing Specific High-Risk Functionality

Specific high-risk functionalities, for example, processing payments or uploading files, ought to be thoroughly tested. File uploads should restrict files that are malicious or unwanted, whilst vulnerabilities such as injection, insecure cryptographic storage, buffer overflows, and password guessing should be checked for in payment functionalities.

Other Articles Worth a Read:

• Testing the Security of Web Applications
• Top 30 Security Testing Interview Questions
• Distinguishing between SAST/DAST/IAST/RASP
• Top 20 Security Vulnerabilities by SANS