Blog

Security testing – choose what you really need. Part I

First of all I want to say that if you ever faced the issues of security testing, but really know few about it in practice, this article is what you need to read. If you are a security tester, well, you can use the article for explanation purposes.
5 August 2014
Cybersecurity testing
The article by a1qa
a1qa

First of all I want to say that if you ever faced the issues of security testing, but really know few about it in practice, this article is what you need to read. If you are a security tester, well, you can use the article for explanation purposes.

So, when security testing is necessary? There are LOTS of reasons, the listed below are basic ones.

Security testing is necessary when:

  • There is a corporate network or web application that wasn`t ever check for security issues or it was REALLY long time ago;
  • The system was successfully attacked or there was a try;
  • New functionality was implemented in a functioning product;
  • Layout of corporate network was heavily changed;
  • The application was migrated from test environment into manufacturing environment;
  • Company follows domain standards (PCI DSS, HIPAA).

In fact, there is a very simple way to define whether you need security testing or not. If you have “something” and this “something” processes important data and can be accessed via the internet – you NEED security testing. What is important data? Everything that is valuable: user personal data, payment cards information, company`s bills, invoices and so on. Even if your application doesn`t store or process important information, do not underestimate possible reputation damage. I think you agree that if someone hacks your website and changes your logo to the competitor`s one, it does you no good.

So, when you finally agree that performing security is a good decision, move to the next step: type of security testing. When you already have security check requirements defined by an outer analyst, it would be much easier to decide. Still, what to do when you literally have nothing?

Option #1: You can approach to a software testing company saying “I have a website/network and want to check its security”, BUT it takes testing specialists several days to define the need and takes you additional costs.

Option #2 (the right one): work out your security testing needs. For that very purpose consider these criteria:

  • Define you testing goals
  • Collect system data to provide analysts with necessary information
  • System entry point (relevant only for testing local networks)

There are two types of security testing: Penetration testing and Vulnerability Assessment.

The goal of penetration testing is enter a web-application internal infrastructure, cease control over the internal servers or access the important information. Doing this testing specialists feign actions of real hackers. The defects detected in the testing process and testing methodology isn`t the main thing here. What is important here is whether the system in its current state is accessible for hackers or not. Testers are to prove that.

Penetration testing takes less time than Vulnerability Assessment and evaluates the efficiency of your security measures.

If you want to know whether it is possible to hack your system, penetration testing is your option.

Next time we`ll go through Vulnerability Assessment and its differences from Penetration testing.

More Posts

5G impact
31 May 2021,
by a1qa
4 min read
5G network impact on mobile app testing
Check out what 5G connectivity will bring to the IT world and how it will modify mobile app testing.
Cybersecurity testing
Mobile app testing
Performance testing
29 April 2021,
by a1qa
4 min read
Addressing 4 security issues for digital transformation programs
Find out the top 4 safety challenges of digital transformation and a QA playbook to address them and contribute to a higher level of cybersecurity.
Cybersecurity testing
31 March 2021,
by a1qa
4 min read
QA scenario to introduce 6 eCommerce trends in 2021
Discover what trends will rule the eCommerce industry in 2021 and how QA can help implement them with confidence and ease.
Cybersecurity testing
Test automation
25 February 2021,
by a1qa
4 min read
9 QA points for delivering high-quality SaaS-based solutions
In the article, we’ve gathered 9 QA factors relying on the SaaS specifics that may help to perform SaaS testing with ease.
Cloud-based testing
Cybersecurity testing
Functional testing
Performance testing
Test automation
16 February 2021,
by a1qa
5 min read
Winning trust: 5 industries that need blockchain testing
Get to know what industries are prone to rapid transformation within blockchain solutions, and how their catch-all testing can help keep leading positions.
Blockchain app testing
Cybersecurity testing
Functional testing
Performance testing
13 January 2021,
by a1qa
4 min read
Reaching HIPAA compliance for eHealth solutions through QA
We reveal the HIPAA’s data safety benchmarks and shed light on how software testing may help in its conformity.
Cybersecurity testing
Software lifecycle QA
30 November 2020,
by a1qa
5 min read
Acumatica: ensuring sound business operations with well-tested ERP system
Internal business activities are advancing, while ERP systems’ usage is growing rapidly. Explore how to ascertain their accurate work through timely applying QA.
Big data testing
Cybersecurity testing
ERP testing
Functional testing
Performance testing
Test automation
19 August 2020,
by a1qa
4 min read
Data migration to the cloud: enable robust transition through QA
With cloud computing being a pervasive technology, many companies still face challenges to set well-tuned information transfer. Learn how to avoid possible quality issues and be confident in data safety.
Cloud-based testing
Cybersecurity testing
Migration testing
Performance testing
24 July 2020,
by a1qa
4 min read
OWASP as a guide to mobile apps security testing
More apps, more sensitive data, higher security levels... Learn how companies address the challenge of providing secure solutions harnessing unbiased safety recommendations.
Cybersecurity testing
Mobile app testing

Get in touch

Please fill in the required field.
Email address seems invalid.
Please fill in the required field.
We use cookies on our website to improve its functionality and to enhance your user experience. We also use cookies for analytics. If you continue to browse this website, we will assume you agree that we can place cookies on your device. For more details, please read our Privacy and Cookies Policy.