7
votes
Accepted
The difference between security audit and security testing
Differences between security audit and security testing
Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes ...
- 9,720
7
votes
Accepted
Should I offer free security tests to my clients?
Should I add value to my engagement by doing free security testing?
No, you should not and the reason is not about money.
Security testings need to always involve your clients' consents, which means ...
- 9,720
7
votes
Accepted
Designing an open source test framework without compromising security
I'm afraid the general answer would be "you have to rely on the community" since the code is visible to huge amount of people, a lot of people review it and anyone is free to publish their concerns ...
- 11.4k
5
votes
Designing an open source test framework without compromising security
Adding to @Alexey R. answer.
You should definitely rely on the community for evaluating and finding security and other issues. The same applies not only for test frameworks but also for tools and ...
- 6,945
5
votes
Accepted
How to bypass antivirus certificate warning in test automation
Try the following:
Click the "lock" icon near the URL in address bar
Click "Certificate"
Switch to "Details" tab
Click "Copy to File..." button
Follow the wizard steps. Save the cert to some file in ...
- 11.4k
4
votes
Is security assessment a one-off task?
how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick?
A security assessment is never a one-off task. Any security assessment ...
- 9,720
4
votes
Accepted
If we can not catch all of security bugs, why do we still test?
It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks.
But the purpose for us to execute ...
- 9,720
3
votes
Designing an open source test framework without compromising security
Developers have the same issue when using open-sources libraries in the application you are building. Most developers also do not have the knowledge of most security risks this brings into their ...
- 32.1k
3
votes
The difference between security audit and security testing
Frequency
A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be ...
- 24.4k
3
votes
The difference between security audit and security testing
An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party ...
- 1,663
3
votes
Accepted
Is security assessment a one-off task?
Typically, for products that are in the market, security assessment is done using a Secure Development Life-cycle (SDLC).
What I do is pretty simple:
Annual External Penetration Test using a crowd-...
- 1,284
3
votes
Accepted
Protecting credentials in Selenium project
I usually will create a .properties file that contains username and password and then make sure my .gitignore file says to not include that file in code check-ins.
- 893
3
votes
I want to learn security testing
To start with, I'd suggest installing Fiddler and exploring your website with it. There's plenty of information available about how to use Fiddler and it makes a decent starting point to explore and ...
- 30.8k
3
votes
Do we need a security officer to safeguard security of an application?
Not really, at least not in this case, but also is not a good thing to place this responsibility to the QA team or to another member of the team, especially if that someone does not have a security ...
- 977
3
votes
Tools used in penetration testing
Below are some of the penetration tools used in security testing services:
Wireshark
This is basically a network protocol analyzer –popular for providing the minutest details about your network ...
- 374
2
votes
Accepted
How to analyze the result of vulnerability scanner
Essentially what Gewure said. The vulnerability you posted an image of is for what is called "command injection". The resulting HTML was because the scanner was able to craft a GET that then returns ...
- 601
2
votes
How to analyze the result of vulnerability scanner
According to the picture you supplied here, one can see that your application might be vulnerble to user-manipulated GET-requests, as stated in the report your assessment-tool supplied.
E.g. one ...
- 123
2
votes
Accepted
Tools used in penetration testing
You can install Kali Linux. It has a massive amount of tools that you can use to perform penetration testing with.
It may take a day or so to download and install. Kali Linux OS link
- 9,720
2
votes
Is security assessment a one-off task?
As said above, security assessment is never a one off, it should be periodically.
The reason for this (when this manager undoubtedly asks) is that new threats are emerging all the time.
These ...
- 423
2
votes
What is security testing? Please suggest how can I start. Any tools or any methods?
There are different types of security testing all with their own path. It could be from actual penetration testing to just risks analysis.
From my experience (in the software development world) ...
- 32.1k
2
votes
Accepted
Vulnerability regression testing in an agile environment
How did you guys set up your vulnerability regression testing?
I have used static analysis tools like HCL AppScan and SonarQube. These run against your source code and can be set up as "checks&...
- 4,030
2
votes
Security test for .net desktop application: upload a file (shell) to check how software behaves
A lot of stuff covered by OWASP applies to applications as the line between desktop app and web app blurs. Things like SQL injection, command injection, object injection to name a few injection ...
- 4,030
2
votes
Accepted
How can someone prevent to become a victim of social engineering?
Continuous education is the key. Implement a strict security policy as well.
Social engineering threat originates from both internal employees and external strangers.
For Internal Employees:
In ...
- 9,720
2
votes
If we can not catch all of security bugs, why do we still test?
Every complex system is like that.
https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
Defense in depth is also used in real life: If security belt in cars don't prevent all car deaths, why ...
2
votes
Is there any reason why preventing Disposable Email Address used to sign up?
Disposable email address cannot be easily tracked. Also, this can be used for fraudulent access to sites which require email authentication. It can also be used to post explicit content on sites and '...
- 81
2
votes
How to Automate UI, API, Performance & Security testing using a single Framework?
My solution is to pick a language, for example Ruby (a good choice imho) or Java or C# as the 'framework' for your solutions (I'm avoiding the word framework lately though, badly abused).
Then select ...
- 24.4k
2
votes
How to calculate security test or penetration test cost for the customer?
I've been involved in organizing penetration testing for my employer's software, and what I've experienced is that the quoted price depends on a combination of:
how big/complex the software is (...
- 30.8k
1
vote
How to Automate UI, API, Performance & Security testing using a single Framework?
You need to choose a performance testing tool which supports all aforementioned requirements, for example take a look at Apache JMeter:
UI tests can be integrated via WebDriver Sampler
API testing ...
- 12.6k
1
vote
Accepted
Security policies and procedures
Can you think of more security policies?
Minimum access, this policy limits access to a need to know basis.
Network access, this policy limits who can access a network.
VPN access (remote access), ...
- 9,720
1
vote
How simple authentication and Token based authentication differs?
This is not a good sign. Try using the request from another machine, send any token, or try without any token. If it works, then you have an issue.
Also be sure that the request receiver is ...
- 327
Only top scored, non community-wiki answers of a minimum length are eligible