29
votes
Accepted
One of my team members executed security test without any consent
As Yu Zhang has said NEVER perform security tests without consent. There are no exceptions to this rule.
You need to make it clear to the team member that senior management would be justified in ...
- 30.8k
14
votes
One of my team members executed security test without any consent
Security tests should be only executed with a written customer's consent.
Your team member's intention might not have been malicious but due to its highly sensitive nature of software security, all ...
- 9,660
11
votes
One of my team members executed security test without any consent
The fact that this thing happened means that there is something wrong in the security testing processes inside your team. At least, there should have been an agreement/consent between both parties - a ...
- 11.4k
10
votes
Accepted
Automation and bypassing Google No CAPTCHA reCAPTCHA
Cleanest solution is to get it removed for QA environment (render it conditionally) - you have one right? You do test BEFORE deploying to production? So don't use CAPTCHA in environment where you run ...
8
votes
Is security testing the sole responsibility of testers or part of a mixed team?
Most of the data breaches come as a result of human error - social engineering, phishing, etc.
I think management should organize security education for everyone. I don't see testers needing to be ...
- 4,079
7
votes
Accepted
The difference between security audit and security testing
Differences between security audit and security testing
Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes ...
- 9,660
7
votes
Accepted
Should I offer free security tests to my clients?
Should I add value to my engagement by doing free security testing?
No, you should not and the reason is not about money.
Security testings need to always involve your clients' consents, which means ...
- 9,660
5
votes
Does adding the port number to a URL redirect pose a Security risk?
There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website".
...
- 151
5
votes
Accepted
Is security testing the sole responsibility of testers or part of a mixed team?
All aspects of quality - functional and non-functional testing - should be solved by the whole team. Introducing a wall where developers develop and testers test introduces hand-offs, which increases ...
- 965
4
votes
Accepted
Payment gateways checklist
I tested credit provider gateways and implementations for years, so I can give a few suggestions:
Security - no matter where you are in the world, there will be security requirements. Some common ...
- 30.8k
4
votes
Accepted
Top 10 Web Application Security Checks
10 security checks for any web application are as follows -
#1 SQL Injection
Code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an ...
- 395
4
votes
Is it possible to automate testing involving Two-factor Authentication?
I found this solution and I think it might be much more useful. You just do the authentication inside your automation: https://dev.to/j_sakamoto/selenium-testing---how-to-sign-in-to-two-factor-...
- 141
4
votes
Ethical Hacking career options for qa professionals
You have a few options if you want to become a security QA.
CEH: please bear in mind, CEH council needs you to demonstrate that you have worked in software security industry for a few years otherwise ...
- 9,660
4
votes
Is security assessment a one-off task?
how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick?
A security assessment is never a one-off task. Any security assessment ...
- 9,660
4
votes
Accepted
If we can not catch all of security bugs, why do we still test?
It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks.
But the purpose for us to execute ...
- 9,660
4
votes
How to do automated SSL server testing?
The first thing that comes to my mind is sslyze.
https://github.com/nabla-c0d3/sslyze
I use it for penetration testing, in the event that I can't use online SSL-tests like https://www.ssllabs.com/...
- 141
4
votes
Is there any good browser plugin or tool to quickly identify any security issues of a web site?
Yes for a few things but overall really I feel the answer is no single tool for what you seek.
Reviewing security is a manual process because it is is a multi-faceted process. It will frequently ...
- 24.4k
3
votes
How can I learn more about desktop software security and testing?
Try reading https://security.stackexchange.com/. It is described as "a question and answer site for Information security professionals".
- 22.9k
3
votes
Accepted
Security testing - functional or non-functioal, ISO 9126 vs ISO 25010
ISO 25010 is an updated revision of ISO 9126. Security is considered non-functional.
- 4,030
3
votes
Accepted
Ideas for testing for Man in the middle attack vulnerabilities?
Use Fiddler to inspect network traffic. In addition to clear text passwords you can try to reuse a session token by making a call using Fiddler or PostMan. Also, checkout OWASP's ZAP scanner.
- 4,030
3
votes
How to convince BA that her software requirement may cause problems?
As a tester part of your job is to provide information and to advise others (BAs, Developers, Managers etc.) about the state of the system and any potential risks. With this in mind, what I'd do in ...
- 230
3
votes
Accepted
Security testing for iOS app
You'll find OWASP to be a great resource for security/penetration testing. Start here for iOS.
- 4,030
3
votes
Accepted
Does adding the port number to a URL redirect pose a Security risk?
Showing port 80 is no more harmful that showing "http". In fact, a fully qualified URL should look like this:
http://www.example.com.:80
Many of these pieces are now assumed by the browser in order ...
- 136
3
votes
Do we need a security officer to safeguard security of an application?
Not really, at least not in this case, but also is not a good thing to place this responsibility to the QA team or to another member of the team, especially if that someone does not have a security ...
- 967
3
votes
Accepted
Penetration testing certificate, Kali Linux certificate?
After some digging, I have found this one, Offensive Security Certified Professional, please follow this link for more information. OSCP certificate on Wikipedia
This certificate offer a certain ...
- 9,660
3
votes
Ethical Hacking career options for qa professionals
As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing ...
- 6,890
3
votes
The difference between security audit and security testing
An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party ...
- 1,663
3
votes
The difference between security audit and security testing
Frequency
A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be ...
- 24.4k
3
votes
Accepted
Is security assessment a one-off task?
Typically, for products that are in the market, security assessment is done using a Secure Development Life-cycle (SDLC).
What I do is pretty simple:
Annual External Penetration Test using a crowd-...
- 1,284
3
votes
Accepted
One question from ISTQB security exam, how to test SQL injection efficiently?
The answer is 3.
bbbbb,12345,'
This answer is correct, but from equivalent partitioning point of view, it offers two valid inputs, bbbbb and 12345, from valid input partitioning.
%, ', @, ...
- 9,660
Only top scored, non community-wiki answers of a minimum length are eligible