Questions tagged [security]
For questions regarding the security of test environments.
26 questions
9
votes
3
answers
160
views
Designing an open source test framework without compromising security
Context
The robot framework website mentions robotframework-autoitlibrary in
its external library listing and it points to
http://code.google.com/p/robotframework-autoitlibrary/.And I found a
...
- 11.1k
8
votes
4
answers
2k
views
The difference between security audit and security testing
I am a bit confused by security audit and security testing, do they not both test against security holes?
What are the differences between them?
- 1,495
6
votes
4
answers
446
views
Is security assessment a one-off task?
I visited a client today. The manager I was talking to wanted me to perform a security assessment for his team.
He put lots effort in saying "We only need one security assessment, as we need to tick ...
- 1,007
6
votes
2
answers
112
views
Should I offer free security tests to my clients?
I have been engaging a client for two months now. They are a major electricity generation and distribution company.
For each project, I have got more than enough time to finish my SoapUI test cases ...
- 1,007
5
votes
1
answer
924
views
How to bypass antivirus certificate warning in test automation
I have Kaspersky antivirus installed. When I run automated tests in dev environment, I get the warning
Connection not protected
The security of your connection is reduced. Criminals can ...
- 4,119
2
votes
2
answers
129
views
If we can not catch all of security bugs, why do we still test?
Someone asked me a question next to water cooler:
It is unrealistic for us to catch all of the security loopholes, so why do we still execute security tests?
I was speechless, could not provide any ...
- 1,495
2
votes
2
answers
180
views
Tools used in penetration testing [closed]
I would like to perform penetration testing on my project, to make it more secure. and to fix the vulnerabilities and weaknesses in the system.
Vulnerabilities allow attackers to exploit or control ...
user21268
2
votes
2
answers
2k
views
Protecting credentials in Selenium project
Is there a method and/or best practice for protecting credentials in a Selenium project using Java?
The two main ones for my application will be user credentials for logging into the site, and DB ...
- 100
2
votes
1
answer
248
views
Vulnerability regression testing in an agile environment
Starting point:
We used different solutions in the test team to test our websites for vulnerabilities in different ways.
In doing so, we naturally also want to retest the bugs anchored in the backlog ...
- 1,117
2
votes
1
answer
74
views
How can someone prevent to become a victim of social engineering? [closed]
There is a says that "There is no patch for human stupidity" Human is the weakest point of any system, In the field of Security "Social Engineering" is a very popular technique to gather information.
...
- 5,443
2
votes
0
answers
57
views
What is the best tool for network packet analyzing? [closed]
I want to perform penetration testing and assess the network traffic using a packet analyzer. Which tool is used by most people? How does it compare to other Applications, what is the state-of-the-art?...
- 171
1
vote
2
answers
419
views
How to Automate UI, API, Performance & Security testing using a single Framework?
How to Automate UI, API, Performance & Security testing using a single Framework. One test case should check all these things. Any suggestions?
1
vote
1
answer
72
views
Do we need a security officer to safeguard security of an application?
Currently I am thinking about how we can improve the focus of security testing and integration it into our development cycle.
Now I am wondering, do we need a CSO or Security Officer role? Or is it ...
- 32.6k
1
vote
1
answer
42
views
Security policies and procedures [closed]
I am compiling a list of general security policies and procedures at the moment.
The following items have been included:
Acceptable use - this policy defines what behaviors are acceptable and what ...
- 1,007
1
vote
1
answer
429
views
How simple authentication and Token based authentication differs?
I am a newbie in security testing. For some projects, my Project Manager asks me to do a security check. For basic security, I do check whether sensitive data is stored in cookies and whether all the ...
- 1,573
1
vote
0
answers
67
views
Security testing for a AAD authentication web application using OWASP ZAP
I'm having difficulty in how to start security testing for these type of application which has Azure AD authentication. Can someone guide me on how to start this? Do I need to use Zest script for this?...
- 11
1
vote
0
answers
27
views
Is it permissible to save the CVV of a charging card option [closed]
Can we save CVV if we have a save your card option?
What is a secure way to save cvv?
What are the security threats?
- 31
0
votes
4
answers
251
views
How to calculate security test or penetration test cost for the customer?
Details:
A customer would like to know in detail what costs penetration testing causes on the one hand, and what benefits penetration has on the other hand.
Also, what it effectively means to save ...
- 1,117
0
votes
2
answers
134
views
How to analyze the result of vulnerability scanner
I need to do penetration testing, I'm scanning the vulnerability of My Web Application using VEGA tool. I did this using proxy mode set the manual proxy and recorded the actions after login in the ...
- 1,573
0
votes
2
answers
1k
views
I want to learn security testing [closed]
I want to learn security testing. The most important security testing types are : sql injection attacks, cross-site scripting, phishing attack. I don't know how to start learning. I want to find some ...
user21268
0
votes
2
answers
107
views
What is security testing? Please suggest how can I start. Any tools or any methods? [duplicate]
I want to learn security testing. To be candid I have just heard this term and never tried it. Is it beneficial for the product if security testing is done? How can I start? Do organizations value ...
- 917
0
votes
1
answer
67
views
Is there any reason why preventing Disposable Email Address used to sign up? [closed]
I've been tested some of websites and apps, and I noticed that some of them preventing user to Sign Up using Disposable Email Address
First things come to my head, this can be used to join an event ...
- 152
0
votes
1
answer
54
views
Security test for .net desktop application: upload a file (shell) to check how software behaves
I am looking for a most common injection file (shell) to import my software to check if it is open to these kind of attacks or not. Any recommendation, web sites or blogs?
(summary: i will upload ...
- 61
0
votes
1
answer
937
views
Has anyone used Bromium vSentry on their test machines?
My company wants to roll out Bromium vSentry to all their desktop and laptop machines. They tend not to distinguish between general office machines, and machines used for our testing.
Although I have ...
- 14.1k
0
votes
0
answers
14
views
How to automate a fido token login
I need to automate a login which uses a fido token. No person can be behind the screen as it is supposed to be automated. I can build a small device which would move the "finger" up and down....
0
votes
1
answer
181
views
I want to confirm whether Jmeter's IP Spoofing only works on local networks and not for public?
Suppose I want to hit Server A on the internet, I have a public IP aa.aa.aa.aa and local IPs bbb.bbb.bbb.bbb, ccc.ccc.ccc.ccc. When hitting Server A, what will be recorded in the server log is only ip ...
- 3