What are different security testing techniques?

Security testing techniques are needed to defend the vulnerabilities of a software system or application and to protect it from security threats. Every web site and application has some kind of vulnerabilities which weaken the application’s security and exposes it to the exploitation.

The security should be carried out along all other testing phases so that a uniform security is maintained throughout the application and vulnerabilities and threats are discovered and addressed from time to time. But, unfortunately the security testing is usually conducted at the last phase of the development cycle.

PENETRATION & STATIC ANALYSIS TESTING TOOLS
- Penetration testing tools or web application scanners help a great deal in identifying the vulnerabilities of a web site or application.
- The human brain cannot mentally check out the whole source code and aspects for vulnerabilities and weak points.
- Another class of tools that can be used for this purpose is static code analysis tools.
- Both these penetration tools and static code analysis tools are needed for security testing of web sites and web applications.
- These tools work very effectively in digging out the vulnerabilities.
- On the other hand, static code analysis tools belong to the white box testing tools.
- They are used by the security groups to complement the penetration tools and they focus up on finding the specific root vulnerabilities.
- Penetration testing tools are to be used when the tester is having a limited knowledge of the web application under testing.
- These security tools are employed to check out the following security issues:
(a) SQL injection attacks
(b) Cross site scripting attacks
(c) Directory traversal attacks
(d) Issues related to session management
(e) Validation of the supplied input

The penetration testing tools emphasize upon the following security areas of a web site or web application:
- Network security
- Data base security
- Security sub- system
- Web application security

The penetration testing tools though focus up on both the positive and negative requirements; the more emphasis is on the negative ones. On the other hand normal software testing focuses only up on the positive requirements.

TECHNIQUES USED TO CARRY OUT SECURITY TESTING OF WEB APPLICATIONS

1. Fuzz Test Technique
- This type of testing involves injection of various types of generated data at the interface of the web site or application under testing.
- The data is either randomly generated or systematically.

2. Syntax Test Technique
- This type of testing involves generation of both legal and illegal data.
- This data input values are fed to the application and the behavior of the web application is observed i.e., whether it accepts or rejects the input.

3. Data Analysis
- The data generated by the web application is checked and the context of cryptography is employed here.

4. Exploratory Testing
- This testing is carried out without any test plan.
- There are no specific expectations in this type of security testing and the outcomes are also not expected.

5. Scaffolding
- Testers require some support to carry out their own specially designed testing techniques.
- For that they require supportive tools.
- This is termed as scaffolding.

6. Monitoring the behavior of the program
- Automated tools are used to monitor the outcomes of the different security testing techniques applied and also the behavior of the web application is monitored.
- This technique saves a lot of time.

Security testing of the web sites and applications is crucial to the security of the enterprise since the web sites and applications need to be available to the people all time and the threats and vulnerabilities possess a big danger to the cyber world.

User Interface Testing - The Golden Rules

User interface design creates an effective communication medium between a human and a computer. User interface is designed by a software engineer. Interface design focuses on three areas:
- design of interfaces between software components.
- design of interfaces between software and other non-human producers and consumers of information.
- design of interface between a human and computer.

Rules Forming the Basis For A Set of User Interface Design Principles

Place the User in Control: Some design principles that allow the user to maintain control are:
- Define the current state of the interface in a way that does not force a user in to unnecessary or undesired actions.
- Flexible interaction should be provided because different users have different interaction preferences.
- It allows the user interaction to be interruptible and un-doable.
- The user should not be aware of the technical internals like operating system, file management functions etc. The user interface should move the user into virtual world of the application.
- It is good to design a macro mechanism that enables an user to customize the interface to facilitate interaction.
- The interface should be designed in a manner in which user will have direct interaction with objects that appear on screen.

Reduce the User's Memory Load
Some design principles enabling an interface to reduce user's memory load:
- Interface should be designed to reduce the requirement to remember past actions and results. This can be done by providing visual cues that enables a user to recognize past actions rather than to recall them.
- Establish meaningful defaults.
- Shortcuts should be defined that are intuitive in nature.
- The visual layout of the interface should be based on real world metaphor.
- Interface should be organized in a hierarchical manner. The information should be disclosed in a progressive fashion.

Make the Interface Consistent
Consistency means that all visual information is organized according to a design standard, input mechanisms are constrained to limited set used consistently throughout the application and mechanisms for navigating from task to task.Some design principles that helps in making interface consistent are:
- Allow the user to put the current task into meaningful context.
- Consistency should be maintained across a family of applications.
- Do not make changes in past interactive models that have created user expectations unless there is some solid reason to change.

Overview of Localization Testing and what are its focus areas.

Localization is a process of customizing a software application that was originally designed for a domestic market so that it can be released in foreign markets. Localization testing checks the quality of a product's localization for a particular target culture/locale.

Areas of focus in Localization testing
- Localization testing should focus on the areas affected by localization, such as UI and content, culture/locale-specific, language-specific, and region-specific areas.
- The localized checklist includes spelling rules, sorting rules, upper and lower case conversions, printers, size of papers, operating system, key boards, text filters, hot keys, mouse, date formats, measurements and rulers, available memory.
- Localization testing should include basic functionality tests, setup and upgrade tests run in the localized environment and plan application and hardware compatibility tests according to the product's target region.
- Availability of drivers for local hardware.
- Encryption algorithms.
- Focus on customization that could not be automated through the globalization services infrastructure.
- The quality is not usually checked during localization testing.
- Validation and verification of applications, linguistic accuracy, and consistency checks can be purchased separately.
- Localized testing can weed out potential errors, before they are localized and correcting them becomes costly.
- The advantage of localized testing is that it saves time.

High-level Best Practice Four(4) in Software Configuration Management

There are six general areas of SCM deployment, and some best practices within each of those areas. The first, second and third area and there practices are already discussed.

Change Propagation

Propagating file changes across branches needs to be managed. The practices involved with this work space are :
- Do not delay to propagate a change. When it’s feasible to propagate a change from one
branch to another (that is, if the change wouldn’t violate the target branch’s
policy), do it sooner rather than later.
- It is much easier to merge a change from a file that is close to the common
ancestor than it is to merge a change from a file that has diverged considerably.
This is because the change in the file that has diverged may be built upon
changes that are not being propagated, and those unwanted changes can
confound the merge process.
- Changes can be propagated by the owner of the target files, the person who make the original changes, or someone else.

High-level Best Practice One(1) in Software Configuration Management

Software configuration management (SCM) is a set of activities that are designed to control change by identifying the work products that are likely to change, establishing relationships among them, defining mechanisms for managing different versions of these work products, controlling changes that are imposed, and auditing and reporting on the changes that are made.
Software Configuration Management Best Practices are the techniques, policies and procedures for ensuring the integrity, reliability and reproducibility of developing software products.
When implementing SCM tools and processes, you must define what practices and policies to employ to avoid common configuration problems and maximize team productivity. There are six areas of SCM deployment, and some coarse-grained
best practices within each of those areas.
- Workspaces: It is the area where the engineers edit source files, build the software components they’re working on, and test and debug what they have built. The best practices for workspaces include:
. Don’t share workspaces.
· Don’t work outside of managed workspaces.
· Don’t use jello views: A file in your workspace should not change unless you
explicitly cause the change. A “jello view” is a workspace where file changes are
caused by external events beyond your control.
· Stay in sync with the code line.
· Check in often: Integrating your development work with other peoples’ work also
requires you to check in your changes as soon as they are ready.

CMMI - Generic goals and practices in Process Areas

Each process area is defined by a set of goals and practices. There are two categories of goals and practices:
- Generic goals and practices (GG & GP): They are part of every process area.
- Specific goals and practices (SG & SP): They are specific to a given process area.

A process area is satisfied when company processes cover all of the generic and specific goals and practices for that process area.
Capability Maturity Model Integration (CMMI)--CMMI for Development, Version 1.2—contains 22 Process Areas that describe the aspects of product development that are to be covered by organizational processes.

Generic goals and practices

GG 1 Achieve Specific Goals
- GP 1.1 Perform Specific Practices.
GG 2 Institutionalize a Managed Process
- GP 2.1 Establish an Organizational Policy.
- GP 2.2 Plan the Process.
- GP 2.3 Provide Resources.
- GP 2.4 Assign Responsibility.
- GP 2.5 Train People.
- GP 2.6 Manage Configurations.
- GP 2.7 Identify and Involve Relevant Stakeholders.
- GP 2.8 Monitor and Control the Process.
- GP 2.9 Objectively Evaluate Adherence.
- GP 2.10 Review Status with Higher Level Management.
GG 3 Institutionalize a Defined Process
- GP 3.1 Establish a Defined Process.
- GP 3.2 Collect Improvement Information.
GG 4 Institutionalize a Quantitatively Managed Process
- GP 4.1 Establish Quantitative Objectives for the Process.
- GP 4.2 Stabilise Subprocess Performance.
GG 5 Institutionalize an Optimizing Process
- GP 5.1 Ensure Continuous Process Improvement.
- GP 5.2 Correct Root Causes of Problems.