Just like testing the performance of an application, it is also important to perform security testing before the app is open to real users. Security testing is performed to detect vulnerabilities in an application, while ensuring that the data is protected and that the application works as required.
Among the different kinds of applications, web applications demand more security as they involve large amounts of important data and online transactions. The web apps must be tested to ensure that they are not vulnerable to any cyber-attacks.
In order to perform security testing for web applications, the tester must be well versed in HTTP protocol. He/she should have a clear understanding of how the client (browser) and server communicate using HTTP. The tester is also expected to know at least the basics of SQL injection and XSS. Though the number of defects regarding the security of web apps is comparatively low, the tester must take note of each defect detected, in detail.
While performing security testing, here’s the list of vulnerabilities a tester must keep check on:
The most common way of a cyber attacker to gain access to a web app is by cracking the password. They may try to guess the password or use a password cracking tool to conduct the same. Therefore, the security tester must ensure that the app demands a strong password that must be encrypted.
It’s easy to edit the URL in a browser. Lack of security can cause the users to be redirected and confidential data being leaked. Therefore, it is important for the security tester to check if the application passes vital data through its URL string. The web app becomes vulnerable to URL manipulation mainly when the app uses the HTTP GET method to pass information between server and the client, which is usually passed in parameters in the querystring. A security tester can just change a parameter value to see if the server accepts it.
Sometimes, a hacker may feed in illegal SQL statements to a text entry field so as to get access to web app content. If not security tested, the hackers may make use of this vulnerability to add, change or erase the data from the SQL-based database of the web app. While security tested, is even a single quote entered into the text field is rejected by the application, we can make sure that the app is safe. However, if the tester enters a quote and the app accepts it, but, shows a database error, the web app is vulnerable to SQL injection.
Cross site scripting (XSS)
It is important to make sure that the web app is not prone to cross site scripting because if the attacker enters harmful script into your web app, you may end up unknowingly helping them to deliver the script to the people online. Therefore, the tester must ensure that the application rejects any malicious data and if at all it accepts the data, it must not affect the backend.
It is always best to test the app as a whole from a hacker’s point of view. Think of the different technologies used in the making of the app, different levels of access that users have to go through to log in and how the data can be obtained or stored. This will help you to recognize prospective weak points and see if they are vulnerable to common types of cyber-attack.
Also, think of the different methods and scenarios a hacker will try to crack into the app. Do not ignore any points as the hacker may get in through the least expected path.
Steps of security testing
Now, talking about the steps to perform security testing, it differs with different organizations. However, the basic process remains the same.
- Understand what the business is about and its security goals. This helps to plan the test by considering all security needs of the organization while not going overboard
- Understand and identify the security needs of the application
- Gather all information regarding system setup information that was used for developing the web app and network such as the OS, technology, hardware etc.
- Identify the possible vulnerabilities and risks and make a list
- Prepare a threat profile based on the list
- Prepare test plan according to the identified possible vulnerabilities and risks
- Prepare Traceability Matrix for each risk and vulnerability
- Manual security testing can’t always be accurate and therefore, automated testing is also required. Make a list of the tools to be used for the same
- Make the Security tests case document ready
- Carry out the Security Test cases execution and once the identified defects have been fixed, retest
- Execute the Regression Test cases
- Create a detailed report on the security testing conducted, the vulnerabilities and risks identifies and the risks that still persist
With some many advancements happening in this era of digitalization, we need to give considerable focus on filling gaps of vulnerability, minimizing hacker risks, and thereby securing our digital assets, in this case web applications.