7 votes
Accepted

The difference between security audit and security testing

Differences between security audit and security testing Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes ...
user avatar
  • 9,720
7 votes
Accepted

Should I offer free security tests to my clients?

Should I add value to my engagement by doing free security testing? No, you should not and the reason is not about money. Security testings need to always involve your clients' consents, which means ...
user avatar
  • 9,720
7 votes
Accepted

Designing an open source test framework without compromising security

I'm afraid the general answer would be "you have to rely on the community" since the code is visible to huge amount of people, a lot of people review it and anyone is free to publish their concerns ...
user avatar
  • 11.4k
5 votes

Designing an open source test framework without compromising security

Adding to @Alexey R. answer. You should definitely rely on the community for evaluating and finding security and other issues. The same applies not only for test frameworks but also for tools and ...
user avatar
  • 6,945
5 votes
Accepted

How to bypass antivirus certificate warning in test automation

Try the following: Click the "lock" icon near the URL in address bar Click "Certificate" Switch to "Details" tab Click "Copy to File..." button Follow the wizard steps. Save the cert to some file in ...
user avatar
  • 11.4k
4 votes

Is security assessment a one-off task?

how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick? A security assessment is never a one-off task. Any security assessment ...
user avatar
  • 9,720
4 votes
Accepted

If we can not catch all of security bugs, why do we still test?

It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks. But the purpose for us to execute ...
user avatar
  • 9,720
3 votes

Designing an open source test framework without compromising security

Developers have the same issue when using open-sources libraries in the application you are building. Most developers also do not have the knowledge of most security risks this brings into their ...
user avatar
3 votes

The difference between security audit and security testing

Frequency A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be ...
user avatar
3 votes

The difference between security audit and security testing

An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party ...
user avatar
  • 1,663
3 votes
Accepted

Is security assessment a one-off task?

Typically, for products that are in the market, security assessment is done using a Secure Development Life-cycle (SDLC). What I do is pretty simple: Annual External Penetration Test using a crowd-...
user avatar
  • 1,284
3 votes
Accepted

Protecting credentials in Selenium project

I usually will create a .properties file that contains username and password and then make sure my .gitignore file says to not include that file in code check-ins.
user avatar
  • 893
3 votes

I want to learn security testing

To start with, I'd suggest installing Fiddler and exploring your website with it. There's plenty of information available about how to use Fiddler and it makes a decent starting point to explore and ...
user avatar
  • 30.8k
3 votes

Do we need a security officer to safeguard security of an application?

Not really, at least not in this case, but also is not a good thing to place this responsibility to the QA team or to another member of the team, especially if that someone does not have a security ...
user avatar
  • 977
3 votes

Tools used in penetration testing

Below are some of the penetration tools used in security testing services: Wireshark This is basically a network protocol analyzer –popular for providing the minutest details about your network ...
user avatar
2 votes
Accepted

How to analyze the result of vulnerability scanner

Essentially what Gewure said. The vulnerability you posted an image of is for what is called "command injection". The resulting HTML was because the scanner was able to craft a GET that then returns ...
user avatar
  • 601
2 votes

How to analyze the result of vulnerability scanner

According to the picture you supplied here, one can see that your application might be vulnerble to user-manipulated GET-requests, as stated in the report your assessment-tool supplied. E.g. one ...
user avatar
  • 123
2 votes
Accepted

Tools used in penetration testing

You can install Kali Linux. It has a massive amount of tools that you can use to perform penetration testing with. It may take a day or so to download and install. Kali Linux OS link
user avatar
  • 9,720
2 votes

Is security assessment a one-off task?

As said above, security assessment is never a one off, it should be periodically. The reason for this (when this manager undoubtedly asks) is that new threats are emerging all the time. These ...
user avatar
  • 423
2 votes

What is security testing? Please suggest how can I start. Any tools or any methods?

There are different types of security testing all with their own path. It could be from actual penetration testing to just risks analysis. From my experience (in the software development world) ...
user avatar
2 votes
Accepted

Vulnerability regression testing in an agile environment

How did you guys set up your vulnerability regression testing? I have used static analysis tools like HCL AppScan and SonarQube. These run against your source code and can be set up as "checks&...
user avatar
  • 4,030
2 votes

Security test for .net desktop application: upload a file (shell) to check how software behaves

A lot of stuff covered by OWASP applies to applications as the line between desktop app and web app blurs. Things like SQL injection, command injection, object injection to name a few injection ...
user avatar
  • 4,030
2 votes
Accepted

How can someone prevent to become a victim of social engineering?

Continuous education is the key. Implement a strict security policy as well. Social engineering threat originates from both internal employees and external strangers. For Internal Employees: In ...
user avatar
  • 9,720
2 votes

If we can not catch all of security bugs, why do we still test?

Every complex system is like that. https://en.wikipedia.org/wiki/Defense_in_depth_(computing) Defense in depth is also used in real life: If security belt in cars don't prevent all car deaths, why ...
user avatar
2 votes

Is there any reason why preventing Disposable Email Address used to sign up?

Disposable email address cannot be easily tracked. Also, this can be used for fraudulent access to sites which require email authentication. It can also be used to post explicit content on sites and '...
user avatar
  • 81
2 votes

How to Automate UI, API, Performance & Security testing using a single Framework?

My solution is to pick a language, for example Ruby (a good choice imho) or Java or C# as the 'framework' for your solutions (I'm avoiding the word framework lately though, badly abused). Then select ...
user avatar
2 votes

How to calculate security test or penetration test cost for the customer?

I've been involved in organizing penetration testing for my employer's software, and what I've experienced is that the quoted price depends on a combination of: how big/complex the software is (...
user avatar
  • 30.8k
1 vote

How to Automate UI, API, Performance & Security testing using a single Framework?

You need to choose a performance testing tool which supports all aforementioned requirements, for example take a look at Apache JMeter: UI tests can be integrated via WebDriver Sampler API testing ...
user avatar
  • 12.6k
1 vote
Accepted

Security policies and procedures

Can you think of more security policies? Minimum access, this policy limits access to a need to know basis. Network access, this policy limits who can access a network. VPN access (remote access), ...
user avatar
  • 9,720
1 vote

How simple authentication and Token based authentication differs?

This is not a good sign. Try using the request from another machine, send any token, or try without any token. If it works, then you have an issue. Also be sure that the request receiver is ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible