What are the security problems faced by a network?

Making mistakes concerning the network security is very common. The same mistakes are repeated again and again. These problems cannot be solved without changing our working methods. In this article we discuss about some common security problems that are faced by a network.

ØUsing weak and non-complex passwords for accessing the network: 

- Brute forcing is an old school exploit to which many of the system network administrators are open to. 

- The very famous captcha technology has been implemented for correcting this vulnerability of the network security passwords. 

- In the common captcha, the user is required to type in the digits or the letters that are displayed on the screen in some sort of distorted image. 

- This technology has been designed to prevent the network to be accessed by unwanted internet bots.

- However, this is not as safe as it looks. 

- It just gives a false sense to the network admins for countering the brute forcing. 

- Complex password is the solution for this problem. 

- For creating a complex password, more than seven characters need to be combined with special characters and numbers. 

- Apart from the creation of the complex passwords, a password expiration system has to be implemented. 

- This system is for reminding the users for changing their passwords. 

- Also, care should be taken regarding the reuse of the passwords. 

- Cycling of the passwords should not be allowed.

Ø Using server application or software that is outdated: 

- The patches are released by the companies from time to time for ensuring that the system does not become vulnerable to the various threats. 

- Also, new exploits and threats are posed by the hackers that can harm the network if the patches are not properly used. 

- For ensuring the network administrator is kept informed of the new threats, the software or the applications have to be updated regularly.  

Ø Web cookies: 

- Even though the viruses and malware cannot be introduced in to the network through cookies, these cookies can be tracked by some third party cookies for compiling the records of the browsing histories of the individuals. 

- The cookies that are not encrypted pose a major threat because they make the system vulnerable to the cross site scripting (XSS) attacks, thus putting your privacy at risk. 

- The open cookies can provide access to the cookies with the log-in data which can be used by hackers for intruding in to your systems. 

- The solution to this problem is to use the encrypted cookies along with an encoded expiration time. 

- The admins might ask the users to re-log-in before accessing important network directories.

Ø Plain hashes: 

- Hashing is the technique used for indexing and retrieval purposes in the database. 

- In most of the encryption algorithms, the plain hashes are mostly used. 

- A type of encryption is the salt that might be added to the hashes for making the creation of a look-up table that might assist the brute force or directory attacks extremely difficult or let’s say almost impractical. 

- But this works only when large salt is used. 

- Usually a pre-computed look up table might not be used by the attacker in exploitation of the network. 

- This makes the network security system even more complex.

- So even if the attacker is able to break into your system, he won’t be able to access the information from the database. 

- The encryption key should be kept hidden.

Ø Shared web hosting: 

- This service is used by the websites that reside on one same server. 

- Each site is given its own partition. 

- This is economically feasible for most of the systems. 

- But here if the attacker breaches in to system of one website, he can get into other website’s security systems too. 

What are the risks and liabilities with instant messaging?

There are a number of risks and liabilities associated with Instant Messaging. Till today several attempts have been done in order to create a unified IM standard. 

Few have been mentioned below:

1. Session initiation protocol or SIP of IETF.
2. SIP for instant messaging and presence leveraging extensions or SIMPLE.
3. APEX or application exchange.
4. IMPP or instant messaging and presence protocol.
5. XMPP or open XML – based extensible messaging and presence protocol.
6. Instant messaging and presence service of open mobile alliance (this one was developed exclusively for the mobiles.)

Although a number of benefits are given by instant message, there are also many risks and liabilities associated with it. This happens particularly when one uses IM at his/ her workplace. 

Associated risks and liabilities are:

1. Security risks
2. Inappropriate use
3. Compliance risks
4. Trade secret leakage

About Security Risks

- Security risks involve infecting the systems with viruses, worms, spyware and Trojans etc.

- Hackers and crackers make use of IM vectors for making phishing attempts, introducing the file attachments laden with virus and poisoned URLs. 

- Two main methods are used by the hackers for delivering the malicious code via instant messaging:

1. Delivering viruses, spyware or Trojan horses through an infected file.
2. Using the socially engineered text that has a web address enticing the recipient to go to an URL that in turn connects him/ her to a malicious website.

- The first kind of means i.e., the Trojans, worms and viruses propagate themselves by infecting the whole contact list of the user. 

- An attack done through means of a poisoned URL may infect 1000s of user’s system in a very short duration i.e., just when each of the person in the user’s contact list receives a message that appears to be from a trusted source. 

- Thus, when the recipients click on the web address, the whole cycle repeats. - Such infections might be for some criminal or a nuisance reasons. 

- These attacks are getting more sophisticated with time. 

- The connections in the instant messaging are usually in plain text. 

- This is what that makes them vulnerable to threats such as eavesdropping. 

- Also, with instant messaging, the UDP ports are left exposed to the world inviting many potential security vulnerabilities and raising many security issues.

About Inappropriate Use

 

- All the organizations, be of any type need protection against the liability of the inappropriate use of the IM service by the employees. 

- The nature of the IM, be it immediate, informal or anonymous marks it as an abuse of the workplace. 

- In a number of nations, a legal responsibility has been set up by the corporations in order to make sure that the working environment is free of any harassment for the employees. 

- Instant messaging is now included as an integral part of the policies of the companies regarding the appropriate use of services such as e – mail and world wide web and some other corporate assets.

About Compliance Risks

- Using the IM services at workplace also induces a risk concerning the non – compliance to laws and regulations that govern the use of electric communications. 

- The need for the production of the archived business communications that would satisfy the judicial requests is what to which most of the common regulations is related to. 

- There are a number of IM communications falling under the category of business communications and are retrievable. 

What are benefits of instant messaging?

Instant messaging comes with both risks and benefits. Here we focus up on its benefits.

Benefits of Instant Messaging

1. IM serves to be of great advantage in the environments that are geographically dispersed. The major benefit here is that it cut downs on the cost of expensive phone calls.
2. The communication channels can be augmented with the help of instant messaging. This will become clear from the following: suppose there is a conversation going between an external client and the team members can converse within themselves using IM for clarification of some points or plotting a strategy. Here, the IM is said to serve as a back channel.
3. IM serves as an efficient tool for clearing up the clutter on desktop and lets you respond immediately. Most of the business processes are time sensitive: problem resolution, crisis management, customer service etc. to name a few. IM is the solution for all these processes.
4. IM serves well in case of an emergency. The critical information can be rapidly disseminated to the whole company or individuals in cases such as that of health issues. Natural catastrophes, schedule changes, or network outages etc. most of the times, the network of IM services works well when most of other e – mail and phone networks are down.
5. A number of work groups can be linked through IM. Thus, it acts as a bonding between the two groups. The productivity of the ad-hoc contacts can be increased by enabling them to be quickly added to some work group.
6. IM services can also be used for routing the IMs to cell phones through the IM – to – SMS (short messaging service) gateway services. An example of such a service is find – me service.
7. Through IM services people have a quick reach to the experts if they want to survey multiple consultants or to have an instant consultation.
8. IM is a sort of self–service. People can place queries to the human resource virtual agents via person to machine IM services for obtaining information regarding enrollments or benefits. This also provides the staff with access to the data and speeds up the business processes.

More about Intant Messaging

- IM is one of the few small things that are a must for the effective communication 

- However, IM is embraced as a useful utility at workplace by some owners of small businesses. 

- IM services have been used to completely replace the traditional methods of communications or to provide support them. 

- IM is also a real – time means for communication. 

- But the text records of the IM conversations are kept by the exchange just as in the case of e–mail messages.

- This lets the IM function as a quick conference call without having the employees leave their desks. 

- It acts as a powerful means for bringing all the people on a web page common to all.  

- IM is an effective tool for conducting group chat. 

- Nowadays, such IM platforms that allow for group text chatting. 

- Plus, they also allow you to save the chat history. 

- Team members that are at some off- site locations can be connected through IM. 

- Through IM it becomes easy to stay connected and archive files.

How Instant Messaging Works?

Instant Messaging or IM is a very popular trend among all these days. A number of instant messaging services today offer features such as web conferencing, voice over IP and other video calling features. With such features both the IM features and video calling abilities can be integrated. 

About Working of Instant Messaging

- Each IM service has its own client that may be either a browser based client or some separate piece of software.

- These clients typically work with their sole company but some are designed in such a way that they support other services also. 

- There are some other third party clients that can connect with a number of major IM services. 

- Few such examples are Miranda IM, Trillian, Adium and so on.

- The IM program installed on your system connects to the IM Company via internet. 

- Here the user’s identity is verified. This process is termed as authentication. 

- After verification, the information or the ‘messages’ can be start exchanging between the users. 

- This IM program installed on your system is called the IM client. 

- When you start it up, it connects to the IM server of its company. 

- To log in to the IM service, you need to have an user ID and password. 

- Once they are verified to be correct, you are logged in. You are connected to the IM network. 

- A list of your friends who are currently online will be displayed. Your list will be changing as per who all are signing in and out. 

- People might have set different IM status such as ‘online’, ‘offline’ or ‘busy’ etc. when you type a message to your friend and hit enter; this message reaches him after traveling from your IM client through the IM server to which it is connected.

- The messages you send reach directly to your friends. 

- A pop up IM window displays your message to them. 

- As the chat progresses further, the messages travel to and fro between the two clients with very less delay of time. 

- Consider sending a file to your friend. You attach the file to the text and press enter. 

- Then your IM client will place an inquiry at the IM server to know the status of your friend. 

- If your friend is connected to internet, a direct connection to his IM client is established.

- The reason for using a direct connection is that it is much faster and efficient rather than sending files through a number of intermediate servers in case of an indirect connection. 

- Also, using a direct connection saves on bandwidth. 

- Instant messages are quite small in size and messages of a whole month may sum up to only 1 megabyte that is quite a tiny amount of space.

- This also enables instant messaging services to work equally on slow as well as fast internet connections.

How Inter-operability is supported by Instant Messaging?

- An instant messaging service can support a number of simultaneous conversations. 

- These are small applications that can cater to only small business needs. 

- But for larger organizations more sophisticated applications are required that can work in cooperation. 

- The enterprise versions of these applications provide solution to these problems.

- Some examples of larger IM applications are:

1. XMPP
2. Lotus same time
3. Microsoft office communicator and so on.

- These applications can be integrated with the workflow systems.

- These applications are also known as EAI or enterprise application integration as per certain constraints such as data storage in a specified format. 

- Several attempts have been made for creating a unified standard. 

What is meant by Instant Messaging?

Almost everyone today is familiar with the term ‘Instant messaging’ or IM in short. 

- This is a type of communication that sustains over the internet and quickly transmits the text based messages between people (i.e., senders and receivers). 

- The basic purpose of IM is to provide “real time direct written language–based online chat”. 

- It does this through push mode and other shared clients between two or more people using personal communication devices (mobiles) and personal computers. 

- A network such as the internet is used for conveying the text message for the person it is intended for. 

- IM addresses two kinds of communications namely:

1. Point – to – point communications i.e., from one person to another one person.
2. Multicast communications i.e., from one sender to a number of receivers.

- Nowadays, much enhanced modes of communication have been introduced by advanced instant messaging services. 

- Some enhancements are inclusion of video chat, audio calling and hyperlinks to other media etc. 

- The umbrella term is the online chat under which the concept of IM falls. 

- The similarity between them is that they are text based, happens in real time and offer bi – directional flow of messages. 

- The only distinction is that the IM is based up on clients. 

- The connections between the known users are facilitated by these clients only through a contact list (also known as friend list or buddy list).

- On the other hand, chat works up on web – based applications that facilitate communication between multiple users.

- A number of communication technologies that facilitates text based communication are combined together to provide the service of instant messaging. 

- The biggest feature of the IM – chats is that they take place in real time just like a phone call. 

- IM is different from the other web services such e–mail in the sense that users here perceive the “quasi – synchronicity of the communications”. 

- In IM, you can message only those people who are online at that time. 

- However, there exist some systems that allow you to message offline people, thus drawing some similarity between e–mail and IM.

- IM is cheap and effective means for efficient communication. 

- It allows immediate receipt of the message and also enables us to reply back immediately. 

- However, it is not necessary that the transaction control might support the IM. 

- In some cases there are additional features that make IM more interesting as mentioned below:

1. Enabling users to see each other via web cam.
2. Using headphones and microphones and talk for free over internet.
3. File transfers
4. Saving a text conversation for future reference.

- Instant messaging came much before the internet and first appeared on systems such as multics (multiplexed information and computing service) and CTSS or compatible time sharing system which are multi – user systems. 

- Some of the IM services such as ytalk, talk, ntalk and so on, peer – to – peer protocol.

- Some other examples of early IM services are:

1. Zephyr notification service
2. Bulletin board system or BBS
3. Freelancin round table
4. Compuserve CB simulator: this was the first dedicated online chat service

- Real time text was also a feature of these early instant messaging services.   

- AOL’s real time IM implements the modern real time text feature as an optional feature. 

- Video calling features such as web conferencing services can integrate both IM abilities and video calling.

Explain TestOptimal - Web Functional/Regression Test Tool

About TestOptimal Testing Tool

- TestOptimal provides a convenient way for the functional/ regression/ load/ stress testing of the web–based applications in an automated way. 

- It also works for the java applications. 

- The technology behind the TestOptimal testing tool is the MBT or model based testing and some mathematical optimization techniques. 

- It generates as well as executes the test cases directly from the model of the application. 

- Actually, TestOptimal is itself a web – based application. 

- It has facilities for integrating it with the JUnit. 

- Furthermore, it can be run along with the NetBeans and Eclipse.

- Another striking feature of TestOptimal apart from the technology is that it uses is the application modeling with graphs.

- Example of such graphs are the state chart XML or in short SCXML. 

- These charts have drag and drop user interface that are capable of running  on  the standard browsers. 

- TestOptimal has a number of test sequencers that effectively meet the testing needs of different users. 

- Mscript or java is used for the automation of the tests i.e., the XML – based scripting. 

-TestOptimal provides statistical analysis of the virtual users and test executions required for load testing. 

- TestOptimal can be integrated with other tools such as QTP, quality center etc. with the help of its web service interface. 

- TestOptimal supports multiple browsers on a number of platforms such as Unix, Linux and Windows.

- The following constitute this model – based test automation suite for load and performance testing:

1. Test optimal basic MBT
2. proMBT
3. enterprise MBT
4. runtime MBT

- Model based testing and DDT (data driven testing) are combined together by the TestOptimal so as to provide a sophisticated and efficient test automation and test case generation tool. 

- With MBT, one can find the defects in the early stages of the development cycle, thus enabling a quick and efficient response. 

- TestOptimal animates the test execution that provides the user with an insight in to the testing. 

- This also enables the user to validate the model visually. 

- It also lets you track the requirement coverage.

-The test cases can be visualized with the help of various graphs. 

- For achieving the desired test coverage, there are a number of algorithms capable of generating requires test sequences. 

- The same automation scripts and models can be re–purposed if the user wants to perform load and performance testing.

- TestOptimal helps you cut down the length of the development cycle and at the same time achieving desired test coverage. 

- This in turn improves you response to the frequent changes and makes you confident about your software.

- With TestOptimal, it is sure that over 90 percent of your coverage requirements will be met and release turnaround time will be improved. 

Features of TestOptimal

Below we state some unique features of this excellent testing tool:

1. Finite state machine notation via MBT modeling.
2. Superstate and sub-model: With this feature a larger model can be partitioned in to smaller library components that are reusable.
3. Graphs: It provides various graphs such as the MSC (message sequence chart), coverage graph, model graph, sequence graphs and so on.
4. Model import and merge: It offers various modeling formats based up on XML and UML XMI such as the graphML, graphXML and so on.
5. Test case generation: It comes with many sequencers such as the optimal sequencer, custom test case sequencer, random walk and so on.
6. Scriptless data driven testing
7. Scripting offered in mscript and java.
8. ODBC/ JDBC support: Relational databases can be accessed and operations such as reading, writing, storing and verifying test results can be performed.
9. Integration with REST websvc, JUnit, java IDE specifically netbeans and eclipse, remote agents and so on.
10. Cross browser testing support on browsers such as chrome, IE, opera, firefox and safari.

Explain FuncUnit and QUnit - Web Functional/Regression Test Tool

FuncUnit and QUnit are both tools developed for web functional and regression testing. In this article we first discuss about the FuncUnit testing tool.

About FuncUnit Tool

- It is an open source framework and therefore free to use. 

- The API that this tool uses is based up on the JQuery.

- FuncUnit can either be used as a standalone application or a part of the JavaScript full stack framework. 

- This JavaScript framework is commonly known as the JavaScript MVC. 

- Almost all the modern browsers are supported by FuncUnit on almost all the platforms such as mac, linux etc.

- The tool also offers you a choice of running the tests through selenium. 

- An integrated development environment or IDE called funcIT is also available for this tool. 

- Another component is there using which synthetic events can be created and default event behavior can be performed.

- It is known as the Syn and it can simulate events such as dragging the mouse, clicking, typing and so on. 

- Using syn complex JavaScript functional testing can also be carried out. 

- FuncIT lets you do the testing directly in the browser. 

- Writing, running and debugging of the tests takes place in the web browsers. - FuncUnit makes this all so easy. 

- You just need to open a page and start the debugger. 

- FuncUnit uses syntax similar to that of the JQuery. 

- This is the perfect web testing tool for you if like short and flexible test cases.  - You can run the tests in any of the browsers and later automate them via selenium. 

- FuncUnit supports the following versions of the modern browsers:

1. Internet explorer version 6 and above.
2. Firefox version 2 and above.
3. Safari version 4 and above.
4. Chrome
5. Opera version 9 and above.

- Platforms supported are mac, PC and Linux. 

- In other words you have a complete automated testing suite.

- Some of the features are:

1.   Functional testing

2.   High fidelity

3.   Automated

4.   Free

5.   Multi – system

6. Easy to write

About QUnit Tool

 

- QUnit is based on the similar lines as that of the junit which is a unit testing framework. 

- This testing tool works on the JavaScript test suite (that is used by the JQuery project) for testing the code. 

- It comes with various plug – ins which render it the ability to test any generic JavaScript code. 

- Though, QUnit is somewhat similar to Junit, it does uses features of JavaScript for helping with the testing chores in the web browser like starting and stopping the facilities to carry out tests for the asynchronous code. 

- QUnit is quite a powerful unit testing framework used in JQuery mobile projects, JQuery UI and so on.

- You can get QUnit from JQuery CDN and the latest release id version 1.11.0. 

- John Resig is the person behind QUnit.

- Earlier in 2008, QUnit was completely dependent up on JQuery but now it can be used as a standalone application. 

- Common JSunit testing specifications are followed by the assertion methods of QUnit.

- For automated testing writing your own testing framework involves a lot of work since you have to cover all the requirements of JavaScript code. 

- QUnit makes this all easy. 

- You need to include only two QUnit files on the page namely:

QUnit.js: This is the test runner file and

QUnit.css: This styles the test suite so that the results can be displayed.

- Assertions are essential elements of all the unit tests and the QUnit provides 3 namely:

Ok()

Equal()

Deepequal()

Explain SlimDog - Web Functional/Regression Test Tool

About SlimDog

- SlimDog is a web application testing tool that is based on simple script i.e., the httpunit. 

- The tool comes with a range of commands that help you to work with forms, navigating between the web pages and checking the table contents. 

- The hard task of writing lengthy xml files and JUnit test cases, the slimdog allows the users to create simple text scripts. 

- Each command is a test node that is contained in every line of the script.

- As such all commands contained in a file are treated as a test case and processed as the same. 

- Every command has a syntax that is quite simple as well as easy to learn. 

- If you want, you can form a test suite by combining several test scripts. 

- The results of the tests executed are written as an html page or file to the console. 

How to use SlimDog?

- To use slimdog, firstly you need to download its latest version from its web site. 

- The application will be in zipped form. 

- You need to extract the files to a directory of your choice. 

- Next step is to create a test directory. 

- After this you can start creating tests and save them in the test directory you just created. 

- After you have created the test, your next step is to get the html content. 

- You can run the tests from the command line. 

- After obtaining the results save them to a file. 

- Be careful that the file in which you are saving the result should be defined using the –o argument. 

- You can even navigate from one page to another. 

- All files in the test directory can be run as a test suite. 

- Every test case file must end with .test extension so that it becomes recognizable.

- You can even use a proxy. 

- The slimdog commands can even be used with the JUnit test cases.

- However, running a test case is the easiest way. 

- Firstly, the web tester needs to be instantiated and all commands need to be added through the parse line method.

- You do not have to worry about the syntax since it is the same as that of the script files. 

- After this runtest() method can be called and web test results can be obtained. 

General SlimDog Commands

Below we shall mention some general slimdog commands:

1. Get_html: This command is for establishing a connection with the given URL and thus reading its content. The read content then can be used later. The parameter to this command is the URL itself and it supports variables.
2. Check_title: Parameter for this command is the required title and it is of the type test. The title of the page that you specify is checked against the given title. There is one thing about this test which is that if it fails, the entire test will fail.
3. Set_proxy: The parameters for this command are the proxy port and host. It is of the type command.
4. Check_link (missing): The parameter for this command is the text within the tag and this one is also of the type test.
5. Check_text: The text to be found is passed as a parameter to this command and it is of the type test.
6. Click_link: The argument for this is the text within the tag. It is of the type command.
7. Seturlprefix: The parameter here is the URL prefix. This URL prefix is used as the base URL for other tests. It is of the type command.
8. Enable java_script: Parameter is either true or false. This command disables and enables the JavaScript based on the argument passed.