What is Security Testing ?

Security testing verifies whether an application under test only allows designated users and processes access to business functionality and data.

A testing technique to determine if an information system protects data and maintains functionality as intended. It also aims at verifying 6 basic principles as listed below:

Authorization - is mediating access to resources on the basis of identity and is generally policy-driven (although the policy may be implicit). It is the primary security service that concerns most software, with most of the other security services supporting it. For example, access control decisions are generally enforced on the basis of a user-specific policy, and authentication is the way to establish the user in question.

Confidentiality - is really a manifestation of access control, specifically the ability to read data. Since, in computer security, confidentiality is often synonymous with encryption, it becomes a technique for enforcing an access-control policy.

Accountability - Users of a system should generally be accountable for the actions they perform. In other words, this means that systems should log information on operations that could potentially require review. For example, For example every time we withdraw cash from an ATM a log is maintained and same is displayed in mini-statement or account statement and an alert message is sent to mobile no. Associated with account. These help us to keep track of any unauthorised activity in our account. Likewise,logs generated , should generally be difficult to forge, using a message authentication scheme that protects the integrity of logs by authenticating the entity that performed the logging

Authentication -For network connections, it is important to perform authentication at login time, but it is also important to perform ongoing authentication over the lifetime of the connection; Additionally, for data communications, an initial authentication provides assurance at the time the authentication completes, but when the initial authentication is used to establish authenticity of data through the life of the connection, the assurance level generally goes down as time goes on In data communication, authentication is often combined with key exchange. This combination is advantageous since there should be no unauthenticated messages (including key exchange messages) and since general-purpose data communication often requires a key to be exchanged. Even when using public key cryptography where no key needs to be exchanged, it is generally wise to exchange them because general-purpose encryption using public keys has many pitfalls, efficiency being only one of them. .

Availibilty: Most systems that export resources, either directly or otherwise, come with some implicit understanding that those resources will generally be accessible (available). If an availability problem is caused maliciously, it is known as a denial of service attack. Note that data delays can be considered an availability problem

For eg :- Imagine a QA engineer(testing a bank transaction page ) sending a message that says, "This page failed 5 checklist points" that an attacker delays until the he has robbed the organisation's money and other sensitive information of its customers

Non – repudiation- In most two-party data communication, the two parties can prove to themselves whether data comes from an authentic source. But one generally does not have proof that a third party would find plausible. A message for which the original sender or some endorser can be established to third parties is said to be non-repudiable. This security service is generally associated with digital signature schemes.

Courtesy:OWASP