7
Differences between security audit and security testing
Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes with more technical focus.
Security audit is testing something that is difficult to be tested directly (do passwords change on a regular basis?), while security ...
6
I'm afraid the general answer would be "you have to rely on the community" since the code is visible to huge amount of people, a lot of people review it and anyone is free to publish their concerns about the safety of any particular piece of code. This gives quite a strong belief of there is no backdoors added intentionally.
This of course does not protect ...
5
Adding to @Alexey R. answer.
You should definitely rely on the community for evaluating and finding security and other issues. The same applies not only for test frameworks but also for tools and packages used in your product in production.
But that doesn't make you immediately resilient to problems, scroll through NPM's advisories and you'll see critical ...
5
Try the following:
Click the "lock" icon near the URL in address bar
Click "Certificate"
Switch to "Details" tab
Click "Copy to File..." button
Follow the wizard steps. Save the cert to some file in X.509 format
In file explorer right click that certificate file and choose "Install Certificate"
Follow the steps of import wizard so that your certificate is ...
5
Should I add value to my engagement by doing free security testing?
No, you should not and the reason is not about money.
Security testings need to always involve your clients' consents, which means before security testing is carried out, your clients need to be aware of it and explicitly give you a "green light"; this "green light" needs to be a tangible ...
4
how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick?
A security assessment is never a one-off task. Any security assessment is nothing but a screenshot of an ever-changing process. Saying one security assessment is enough is like to say watching a frame of a film is as good as ...
4
It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks.
But the purpose for us to execute security tests or software tests, in general, is not to find all of the bugs.
The purposes are:
Identify risks and evaluate the effectiveness of existing ...
3
Developers have the same issue when using open-sources libraries in the application you are building. Most developers also do not have the knowledge of most security risks this brings into their application.
This is a serious issue, this article gives some real world examples where security was breached in open-source libraries:
How Hackers Infiltrate Open ...
answered Mar 5 '20 at 12:54
Niels van Reijmersdal
31.4k3 gold badges50 silver badges117 bronze badges
3
Frequency
A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be performed by a different group than those who write the software and the security tests that go with it.
Security testing is a constant on-going practice, ideally ...
3
An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party doing that. Security testing could be for development/penetration/boundary/audit/etc...
In general, I would hope that the security testing performed is ...
3
Typically, for products that are in the market, security assessment is done using a Secure Development Life-cycle (SDLC).
What I do is pretty simple:
Annual External Penetration Test using a crowd-sourced security
testing service.
Weekly static and dynamic scans on the code
Security analysts review new user stories for security impact
Your client may ...
3
I usually will create a .properties file that contains username and password and then make sure my .gitignore file says to not include that file in code check-ins.
3
To start with, I'd suggest installing Fiddler and exploring your website with it. There's plenty of information available about how to use Fiddler and it makes a decent starting point to explore and try to manipulate data going to your application. (I have no affiliation with Telerik - I just use the software as my first pass security tool).
Beyond that, I'...
3
Below are some of the penetration tools used in security testing services:
Wireshark
This is basically a network protocol analyzer –popular for providing the minutest details about your network protocols, packet information, decryption etc. It can be used on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many other systems.
Burp suite is also ...
2
Essentially what Gewure said. The vulnerability you posted an image of is for what is called "command injection". The resulting HTML was because the scanner was able to craft a GET that then returns that data, un-sanitized, back into the page your service creates when sent that GET request. It's likely not the request that is problematic, it is what ...
2
According to the picture you supplied here, one can see that your application might be vulnerble to user-manipulated GET-requests, as stated in the report your assessment-tool supplied.
E.g. one could change EventId to something like ../../ which could be a LFI (Local File Inclusion) vulnerability.
Same is true for FirstName, LastName, EmailID, ZipCode, ...
2
You can install Kali Linux. It has a massive amount of tools that you can use to perform penetration testing with.
It may take a day or so to download and install. Kali Linux OS link
2
Not really, at least not in this case, but also is not a good thing to place this responsibility to the QA team or to another member of the team, especially if that someone does not have a security training or does not have the right technical skills and level.
What you need is a skilled penetration tester.
If you wish to improve the security of your ...
2
As said above, security assessment is never a one off, it should be periodically.
The reason for this (when this manager undoubtedly asks) is that new threats are emerging all the time.
These threats are both external (new virus/hacker/zero day discovered) and internal (disgruntled employee potentially) or introduced (company brings in new software or ...
2
There are different types of security testing all with their own path. It could be from actual penetration testing to just risks analysis.
From my experience (in the software development world) security testing is often ignored until a client asks for an audit or only executed after a security breach has happened. This greatly depends on the industry and ...
answered May 12 '16 at 8:15
Niels van Reijmersdal
31.4k3 gold badges50 silver badges117 bronze badges
2
A lot of stuff covered by OWASP applies to applications as the line between desktop app and web app blurs. Things like SQL injection, command injection, object injection to name a few injection attacks. I once tested a .Net MVC app by uploading a PHP file and tried to see if the code was executed or presented as raw text when viewed.
As far as tools you ...
2
Continuous education is the key. Implement a strict security policy as well.
Social engineering threat originates from both internal employees and external strangers.
For Internal Employees:
In recent years, the most common factor in security breaching is revenge. People do not walk around with a revenge meter on the top of their heads, so there is no way ...
2
Every complex system is like that.
https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
Defense in depth is also used in real life: If security belt in cars don't prevent all car deaths, why we still use them? If anti-aircraft defense does not shot all bombers, why we bother? Because results with using more layers of defense are better than using ...
2
Disposable email address cannot be easily tracked. Also, this can be used for fraudulent access to sites which require email authentication. It can also be used to post explicit content on sites and 'disappear' after posting so that the perpetrator cannot be tracked. There are many other reasons why disposable email addresses are not encouraged. Hope this ...
2
My solution is to pick a language, for example Ruby (a good choice imho) or Java or C# as the 'framework' for your solutions (I'm avoiding the word framework lately though, badly abused).
Then select tools based on that toolset, for example, for ruby: cucumber, rspec, minitest.
1
You need to choose a performance testing tool which supports all aforementioned requirements, for example take a look at Apache JMeter:
UI tests can be integrated via WebDriver Sampler
API testing is naturally supported via HTTP Request sampler, see Building a WebService Test Plan user manual entry for details.
You can use JMeter for Security Testing as ...
1
Can you think of more security policies?
Minimum access, this policy limits access to a need to know basis.
Network access, this policy limits who can access a network.
VPN access (remote access), this policy limits who can access a network via VPN remotely.
User account management, this policy decides who can create, delete accounts.
Configuration and ...
1
This is not a good sign. Try using the request from another machine, send any token, or try without any token. If it works, then you have an issue.
Also be sure that the request receiver is configured to require authentication (sometimes the user is given the ability to turn the authentication off).
Also, usually there are user roles, and every role has a ...
1
Things have changed now, most of the companies management is Aware that Security testing should be included as part of Testing.Many critical Banking Applications, E-commerce Websites which stores customer Credit details have to oblige to PCI compliance.
To me, it's really interesting field to Dig bugs that may break down your systems and can get access to ...
1
If all goes as planned you should not notice a thing, the goal is to be as seamless as possible. With that said it all depends on how the administrator has configured the policy. Your company should have included some sort of communications advising of potential impact.
BTW Oracle Virtualbox and vSentry cannot coexist, it will install but will not ...
Only top voted, non community-wiki answers of a minimum length are eligible
