Blog/Development

What Is Security Testing: Types and Examples

Copy Link

Praise Iwuh

January 12, 2023

What is Security Testing?

Security testing is a software testing process that analyses computer security mechanisms to uncover flaws or vulnerabilities that may result in security threats. In addition, it ascertains if a system's defence mechanism efficiently protects data from hacking as required. Security testing is the bedrock of Cybersecurity, which shields computer systems from malicious attacks.

It is a form of Software testing, which as the name implies, is the process of analysing software to determine suitability for its intended use. Functional testing focuses on how well the software performs its operations, while non-functional analyses other operations. A typical non-functional testing operation is Security Testing, which this article discusses extensively, covering the following:

What is Security Testing?
How Security Testing Works
Why is Security Testing Important?
Types of Security Testing
Tools for Security Testing
Examples of Security Testing
Conclusion

Before proceeding, we should refresh our familiarity with common terms encountered when discussing Security testing.

Vulnerability: Vulnerability is any weakness in an IT system that an attacker can successfully exploit to gain unauthorised access.

Exploit: An exploit is a tool with which an intruder capitalises on vulnerabilities. This could be code, software, commands, or in a single word, Malware. The act of using exploits successfully is also referred to as exploitation.

Threat: A threat describes the scenario where an intruder embarks on an exploit. A vulnerability that has been exploited is referred to as a threat.

Asset: These are items of value to an organisation. They may be sensitive documents, customer information, passwords, etc.

Risk: A risk is the potential damage a threat poses to the organisation's assets.

Malicious: This defines the intent to cause harm or damage to a software system or application.

Malware: This is any malicious software program used by attackers to exploit vulnerabilities. Examples include keyloggers, spyware, adware, ransomware, viruses, etc.

OWASP: Open Web Application Security Project is a global non-profit charitable organisation comprising an online community of corporations, educational organisations, and individuals committed to providing global tools, resources, and information to improve software security.

How Security Testing Works

Security testing simulates a malicious attack against the subject software or system to uncover and remediate vulnerabilities.

It involves scanning for known software vulnerabilities and attempting to exploit them. Developers then implement the outcome of these tests to remediate those loopholes and strengthen the security mechanism. Security testing can be carried out on newly developed software before its deployment or on existing software. In addition, some forms of security testing take place even before entirely developing the applications.

The standard testing methodologies are:

Black-box Security Testing

Black-box security testing aims to uncover and exploit vulnerabilities from outside the network. In this case, the attacker attempts this exploit blindly, with no inside information on source code, IP configurations, and other relevant data. It is a simulation of an attack by a random hacker to obtain sensitive information or penetrate the security system.

White-box Security Testing

In white box testing, the hacker is equipped with full access to the application, source code, and other information. It aims to determine and exploit vulnerabilities in a system that are exploitable from both inside and outside.

Grey-box Security Testing

Grey-box security testing combines black-box and white-box methodologies. As a result, the attacker is equipped with partial access to a network’s internal workings to cover all threat possibilities.

According to OWASP, the ten commonly known security vulnerabilities are :

Injection

Injection occurs when an attacker exploits a security loophole by inserting their code into a program, imitating an intended user, and gaining unauthorised access to confidential information. Examples of injections include SQL injections, command injections, CRLF injections, and LDAP injections.

Broken Authentication

In poorly implemented authentication and session management calls, attackers can easily gain access to the system under the guise of legitimate users' identities.

Sensitive Data Exposure

When an API relies on insecure data transmission methods, attackers can exploit it to gain unauthorised access to sensitive information like usernames, passwords, and customer data.

XML External Entities

This occurs when an attacker exploits insecure code or integrations to upload malicious XML content.

Broken Access Control

Access control systems oversee access to information and functionality. However, if adequate authentication and access restrictions implementation fails, attackers can circumvent authorisation to imitate privileged users.

Security Misconfiguration

Flaws in security configuration can give attackers easy unauthorised access to the system and its sensitive data.

Cross-Site Scripting

This vulnerability occurs when a web application permits users to input custom code into a URL path that other users can see. This allows an attacker to run malicious code on a browser, hijack user accounts and access histories, remotely control the browser, or spread Trojans and worms.

Insecure Deserialization

Deserializing data from untrusted sources can result in an attacker using untrusted data to manipulate an application, initiate a denial of service (DoS) attack, or remotely execute code or commands to influence the behaviour of a system.

Using Components with Known Vulnerabilities

Many APIs and other third-party components carry well-known vulnerabilities. As a result, they are susceptible to exploitation at any given time.

Insufficient Logging and Monitoring (Human Element)

Poor monitoring practices, such as incompetent logging of errors or attacks, can result in exploitation and data breaches.

Why is Security Testing Important?

To grasp just how necessary Security testing is, you only need to look at the grave potential of damage a data breach can result in. For example, a ransomware attack can lock you out of your system, either permanently or until you pay a ransom.

In light of the statistics report that 560,000 pieces of malware are detected daily, you cannot afford to leave your software security to the mercy of assumptions and luck. Cyber attacks are so prominent today that nobody is above the threat of exploitation.

In July 2022, the Shanghai police reportedly suffered arguably the most massive data breach in history when a database containing 500 million records of Chinese citizens were stolen from their system. In another instance, Facebook lost 533 users’ phone numbers, which were leaked online in a low-level hacker forum.

Microsoft also lost 240 million customer support records which had been left without password protection.

These show that even the big boys are not immune to malicious attacks. While Microsoft, Facebook, and the like can afford to get away with these losses, many startups cannot.

This is unfortunate because 43% of malicious attacks are aimed at small businesses, out of whom only 14% have their software security effectively protected. In 2021, the average cost of a ransomware attack was $1.85 million, and the average cost of a general data breach was $ 4.217 million.

Beyond the financial aspect, security testing also seeks to protect six principal values.

Confidentiality: An organisation should keep customers' information private and secure.

Integrity: Integrity ensures that data records and files are immune to corruption, modification, or deletion.

Availability: This is the simple, straightforward provision of customer information as soon as needed.

Authorisation: This determines the level of user privileges or access to data, files, or services.

Authentication: This verifies the validity or identity of a person or entity seeking access.

Non-repudiation: This is the ability to prove the identity or source of a user or individual performing a particular action.

Any shortcomings in implementing these principles can be directly detrimental to an organisation and may result in loss of information and revenue, damage to the reputation and continuity of the brand, as well as legal liability.

Types of Security Testing

Vulnerability Assessment

This involves using scanning tools to identify weaknesses, flaws, or loopholes in software security systems.

Penetration Testing (Ethical Hacking)

This is a process of imitating malicious attacks against a security system to uncover weaknesses and attempt to exploit them. Penetration testing is done to evaluate defence systems without causing damage. It can be done by trusted hackers or freelancers who carry out the operation and reach out to the organisation.

Risk Assessment

This process identifies assets, their value to the organisation, their vulnerabilities, and threats to them. It also measures the magnitude of the consequences of a successful exploit and the cost of remediation.

Security Scanning (Configuration Scanning)

This process is done by probing for flaws in system configurations. These misconfigurations can be hunted down using manual or automated tools.

Security Assessment

This involves reviewing security practices according to industry-accepted standards. It usually entails a review of codes, audit logs, configurations, and operating systems to verify if they meet published requirements.

Application Security Testing

This is the process of analysing the security system of an application to uncover flaws and vulnerabilities. It aims to identify weaknesses before deploying the application or the earliest possible remediation after launch. The types of application software testing are:

● Static Application Security Testing (SAST)

SAST is used to secure applications by reviewing the source code to uncover vulnerabilities when it’s not running. It is a white-box testing method.

● Dynamic Application Testing (DAST)

DAST identifies potential security vulnerabilities by simulating different attack types against the application while running. DAST tools do not require access to source code and fall under black-box testing.

● Interactive Application Security Testing (IAST)

IAST combines SAST and DAST to analyse code for security vulnerabilities by simulating the user interactions while the application runs.

● Software Composition Analysis (SCA)

SCA tools identify open-source components with known vulnerabilities and suggest possible remediations.

● Mobile Application Security Testing (MAST)

MAST analyses the behaviour of the applications during runtime to identify actions that an attacker could exploit.

Posture Assessment

This is a comprehensive review of an organisation's security practices, and efficiency, using a combined approach of security assessment, penetration testing, and risk assessment.

Failure in these discussed principles would compromise sensitive data, credibility and reputation.

Tools for Security Testing

Some practical Security Testing tools are:

The OWASP ZAP

Zed Attack Proxy functions as an integrated penetration testing tool. You can use it to test your network for vulnerabilities.

Acunetix

Acunetix by Invicti is a simple tool that identifies a wide variety of online security weaknesses and assists security and development experts in resolving them quickly.

SQLMap

SQLMap is a penetration testing tool that automates detecting and exploiting SQL injection flaws and database takeovers. It utilises five SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query, and stacked queries.

Intruder

Intruder is a cloud-based vulnerability scanner that uncovers vulnerabilities in cloud servers, websites, endpoint devices, application bugs, injections, cross-site scripting, missing security patches, and encryption weaknesses.

WireShark

Wireshark is a network analysis tool that reveals minute data about your network protocols, decryption, and packet information.

BeEF (Browser Exploitation Framework)

Browser Exploitation Framework detects an application’s weakness using browser vulnerabilities by using client-side attack vectors to verify the security of an application and can issue browser commands like redirection, changing URLs, and generating dialogue boxes.

W3af

W3af is a web application attack and auditing framework. Its three-pronged function systems include discovery, audit, and attack, which interact with each other to uncover vulnerabilities.

Vega

Vega is a Java-based security testing tool that identifies vulnerabilities by finding and validating SQL injection, cross-site scripting, and inadvertently disclosing sensitive information. In addition, Vega provides automated scanning for brisk testing and proxy interception.

Google Nogotofail

Nogotofail is a program that tests network traffic security that checks applications for known TLS/SSL vulnerabilities and misconfigurations by checking whether the system is vulnerable to man-in-the-middle (MiTM) attacks.

Snyk

Snyk implements real-time semantic code analysis to automatically identify vulnerabilities in code, open-source dependencies, containers, and infrastructure as code.

Examples of Security Testing

Some suitable examples of security testing would be:

● Inputting malicious code in a login query to attempt exploitation of injection vulnerability

● Sending phishing emails to a company address to determine susceptibility to social engineering attacks

● Using Static code analysis tools to scan for coding and architectural flaws

● Probing access control systems to bypass authorisation and access user privileges

Conclusion

Security testing is an essential form of testing for any software system or application because it ensures the protection of authorised access and confidential data, which in turn protects the organization's functionality, profitability, integrity, and continuity.

For perspective, the United States of America budgeted $2.4 billion for software security in 2022, according to Statista.