5

In software engineering, I am familiar with some basic, often-overlapping types of testing, for example:

  • unit testing
  • functional / use-case testing
  • alpha / beta testing
  • branch / boundary testing
  • automated / manual testing
  • white box / black box testing

A fellow student is preparing for an interview, and one of the preferred knowledge areas listed in the job description is "testing network security." He asked me how to describe it, and I was having difficulty doing so.

I can imagine how to verify a network connection through combinations of the testing methods listed above, but are there one or more types of testing that specifically pertain to network security?

Improve this question

2 Answers 2

Reset to default
6

I'd like to point out in contrast to Phil's answer that the OWASP project is related to Application Security testing. Network security testing is much larger, and often doesn't include application security, but rather considers it a separate but very important part of overall security testing.

Network security testing is typically related to network architecture. The design and devices that make up the network.

  • Are firewalls, routers, vpns, servers, etc... positioned and configured properly based on their function?
  • Is the network segmented based on some sort of risk or usage profile?
  • Are there systems in place to detect intrusions or malicious activity on the network? Snort
  • Is authentication/authorization done at the network level? 802.1x
  • Are wireless networks configured securely?
  • Are all systems on the network at the appropriate patch level? Common Vulnerabilities & Exposures
  • Is there a centralized repository of security logs for all devices? NIST - Security Log Management

These are just some of the areas that relate to network security. Each one of them can be huge and can be tested in many different ways.

  • Audit style - asking these questions and verifying their correctness by interviewing employees, or reviewing configurations, network drawings and documentation
  • Automated scan - using a tool to scan the network for known vulnerabilities. i.e Nessus
  • Penetration test - Attempting to break the security of a network using common tools, techniques and exploits. Backtrack

Finally, since this is the SE for Software testing. I'd point you to the security SE to ask anymore detailed questions about the topic.

https://security.stackexchange.com/

Improve this answer
2
  • Good point - and great answer. Hopefully the OP will come back and let us know exactly what was being asked for - if it was the typical HR person writing the job ad then it could mean anything...
    – Phil Kirkham
    Commented Sep 21, 2012 at 18:39
  • Thanks for the great answer, and I was not aware of that stackexchange domain. I look forward to following it in the future. @PhilKirkham my friend spoke with the recruiter, and as it turns out, the network security aspect was not of particular interest (a confusion in HR, perhaps). For my personal experience of developing web applications, I find the OWASP material very useful, but I think BZink's answer really provided the expansive information that I was looking for. Thank you both very much.
    – David Kaczynski
    Commented Sep 21, 2012 at 20:30
2

Get your fellow student - and yourself. - to look st the OWASP top 10 and then look around the other parts of the site, that should open their eyes to security testing

Improve this answer
2
  • Thanks Phil, I sure will. We're at Central Michigan University, not too far from you.
    – David Kaczynski
    Commented Sep 20, 2012 at 0:22
  • 1
    Cool ! Ping me anytime you have testing questions :)
    – Phil Kirkham
    Commented Sep 20, 2012 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.