Security testing – choose what you really need. Part I

First of all I want to say that if you ever faced the issues of security testing, but really know few about it in practice, this article is what you need to read. If you are a security tester, well, you can use the article for explanation purposes.

So, when security testing is necessary? There are LOTS of reasons, the listed below are basic ones.

Security testing is necessary when:

• There is a corporate network or web application that wasn`t ever check for security issues or it was REALLY long time ago;
• The system was successfully attacked or there was a try;
• New functionality was implemented in a functioning product;
• Layout of corporate network was heavily changed;
• The application was migrated from test environment into manufacturing environment;
• Company follows domain standards (PCI DSS, HIPAA).

In fact, there is a very simple way to define whether you need security testing or not. If you have “something” and this “something” processes important data and can be accessed via the internet – you NEED security testing. What is important data? Everything that is valuable: user personal data, payment cards information, company`s bills, invoices and so on. Even if your application doesn`t store or process important information, do not underestimate possible reputation damage. I think you agree that if someone hacks your website and changes your logo to the competitor`s one, it does you no good.

So, when you finally agree that performing security is a good decision, move to the next step: type of security testing. When you already have security check requirements defined by an outer analyst, it would be much easier to decide. Still, what to do when you literally have nothing?

Option #1: You can approach to a software testing company saying “I have a website/network and want to check its security”, BUT it takes testing specialists several days to define the need and takes you additional costs.

Option #2 (the right one): work out your security testing needs. For that very purpose consider these criteria:

• Define you testing goals
• Collect system data to provide analysts with necessary information
• System entry point (relevant only for testing local networks)

There are two types of security testing: Penetration testing and Vulnerability Assessment.

The goal of penetration testing is enter a web-application internal infrastructure, cease control over the internal servers or access the important information. Doing this testing specialists feign actions of real hackers. The defects detected in the testing process and testing methodology isn`t the main thing here. What is important here is whether the system in its current state is accessible for hackers or not. Testers are to prove that.

Penetration testing takes less time than Vulnerability Assessment and evaluates the efficiency of your security measures.

If you want to know whether it is possible to hack your system, penetration testing is your option.

Next time we`ll go through Vulnerability Assessment and its differences from Penetration testing.