Security Testing these days is hot job in testing career path, it would makes you different and special one among Testers. I'd love to learn this particular topic if I have chance. For now, to understand what is security testing, now we just look at a glance the 1250 EUR course of Security Testing that I collect from
testingexperience.com.
----------------------------------------------------
1. What is application security
• What does Application Security deals withBest practices •
2. SDL – Security Development Life Cycle and Threat modeling
• Threats and vulnerabilities •
• The STRIDE categories •
• Creating a threat model •
• The SDL methodology •
3. Writing a security test plan
• How to write security test cases •
• How to set up security testing programs (and how they are different from standard testing)
• OWASP testing best practices •
4. Web technologies & security Technologies
• Http & TCP •
• Servers & Proxies •
• Encryption and Hashing •
• SSL & Digital signatures •
• Authentication Technologies •
• XML WS standards •
5. Common attacks & Demos
• OWASP top ten •
• Buffer Overrun •
• SQL Injection •
• Cross Side Scripting XSS •
• Denial Of Service (many types) •
• Back Doors •
• Spoofing •
• Forceful Browsing & Flow Bypassing •
• Parameter Manipulation •
• Information Disclosure •
• One Click Attack •
• Session Hijacking •
• Cookie Poisoning •
• Directory Traversal •
6. Security Testing Methodologies
• Fuzzing •
• Penetration Testing •
Static / Dynamic analyzing •
7. Testing execution
• Discovery phase •
• The testing checklist •
• Attacks simulation Tools and methods •
◦ Discovery tools ◦
◦ Http Proxies ◦
◦ Fuzzing tools ◦
◦ Crackers (Brute force, Hashing ) ◦
◦ Scanners ◦
• How to choose the correct tool – Tools evaluation
• Explain about security code review •
8. Web Services
• WS basics •
• Networking Attacks simulation tools and methods
• Federation – check the identity system •
9. Documentation
• How to write a security report •
• Mitigations •
10. Lab
• In the Lab the students will test a live demo site using the tools and methods they learned in the class.
• The students will experience all the common web application attacks.
(Source
SecurityTesting_kurz.pdf)
===========================================
Update
July-12-2009:
Download this particular e-magazine specialized for Security Testing
testingexperience02_09 (June-2009) - 11MB - PDF file
===========================================
Security Testing Tips
(Update May-18-2008)
Although it’s a broad term, security testing can be broken down into six basic concepts: Availability, Authentication, Authorization, Confidentiality, Integrity and Non-repudiation. I’ll define each concept briefly, however, I encourage you to research each concept for a better understanding.
* Availability: Assuring that information & communications services are available and maintained for authorized persons when needed.
* Authentication: Assuring the validity of any type of originator, transmission or message. This also gives confidence that information is received by a known and validated source.
* Authorization: Assuring that an individual can allow/deny access to a system/service/operation (e.g. Access control).
* Confidentiality: Ensuring information is accessible only for those with authorized access and to prevent information disclosure to any party other than the intended recipients. Often ensured by encoding information using algorithms (cryptography).
* Integrity: Ensuring received information is preserved successfully with no alteration.
* Non-repudiation: Ensuring action/communication cannot later be denied (usually used by form of authentication and time stamping).
Security Testing Methods:
There are 3 types of testing methods which involve various sets of attacks: Information/system gathering, logical, and injection attacks. Each are used for specific testing results, however various attacks share the same security concepts, and are therefore quite similar to one another.
Information gathering (i.e. system related) attacks
* Client-side source code analysis
* Application reconnaissance
* Error messages analysis
* Directory traversal
These methods include various types of information gathering from a web application/server by means of source code and error message analysis, exposure of directory structure or other attacks which results in information exposure. Here are they are in no particular order:
Logical Attacks
* Cookie poisoning
* Parameter tampering
* Flow bypassing
* Direct access of components files
* Session hijacking
* Penetration testing
* Buffer overflow
These methods relate to various logical attacks which may be executed both manually or via specific tools/scripts. Logical attacks are more sophisticated and thus more interesting & challenging to the tester, who needs to have a good understanding of information technology and specific knowledge of cookies, POST/GET requests & parameters, etc.
Injection Attacks
* SQL injection
* Cross Site Scripting (XSS)
* Scripts injection
These methods relate to various scripts & SQL commands injections into web application forms and are the most common attacks, yet they are both serious and dangerous. Detecting such vulnerabilities in early stages of development can prevent unnecessary flaws.
In my next blog post, I will address some common (and some not-so-common) tools that can make security testing easier and more productive for testing engineers of all experience levels.
In the meantime, happy testing!
Bernard Lelchuk
Bug Battle winner
Source:
Blog uTest.com
