29
A Parameterized Method to Internet Application Security Testing
The internet-based applications accessed through various device platforms have become extremely popular with users as they allow the latter to conduct myriad activities. As such applications offer unfettered access to users at large, they are susceptible to threats from hackers. In fact, hackers are always on the lookout to gain access to such applications to steal confidential data. And since software security testing doesn’t always receive the focus it deserves, any potential vulnerability in the application can remain undetected. According to Statista, threat vectors such as SQL injection, cross-site scripting, malicious file upload, executable code injection, and file path traversal, among others, are increasingly being used by hackers.
An application security testing exercise aims to prevent any unauthorized access to data and its destruction. To begin with, it allows data privacy for the respective users while protecting data from other unauthorized ones. The critical areas that any software security testing needs to cover include:
• Authenticating the identities of users
• Authorization of various data objects – people who can access the data
• The manner of authorization – read, write, change, delete, and others
• Maintaining the integrity of data while it is in transit
• Preventing the deniability of transactions by users through the use of digital signatures
The first challenge to test the security of any internet application is capturing the test requirements. Since such requirements are not known at the planning stage of the project, it becomes a tricky exercise to capture them later. Moreover, the traditional use case approach can be found wanting here as the aim of the software security testing services is to focus on the imponderables or things that should not happen in the application system. In the traditional firewall-based model, once an authorized user gains entry into the application, there is no further security checking involved.
However, with enterprise-level applications, the traditional model needs to be updated by implementing security restrictions at various layers. For example, in the modern security model, the application domain is divided into many regions where each region has a different security level. And since these regions can overlap or be nested, the challenges for application security testing can increase manifold. To address such challenges, security testing should be initiated at the planning and requirement gathering stage as several issues (say, denial of service) cannot be captured later.
Given that many security issues cannot be captured during project initiation, a parameterized method is needed to be followed. In this method, a template is created by listing all security parameters in four below-mentioned steps:
• Prepare a comprehensive list of every possible security issue that can potentially impact the application
• Find out the sub parameters for each security issue
• List the security testing activities for each sub parameter
• Assign the corresponding metric to the priority and security level of each sub parameter
• Capture requirements for security testing
• Analyze and design scenarios for testing
• Test bed implementation
• Test report interpretation
Capture security test requirements: The process includes defining the scope and checking the security requirements as per the template to identify any missing elements. Thereafter, adequate weightage is given to various sub-parameters based on the type of business and the heuristic data available therein. The weightage helps to optimize test scenarios for every parameter. To cite an example, in any eCommerce application, authentication, confidentiality, and non-repudiation can be the key parameters to check for a user who has provided the payment information.
Analyze and design test scenarios: After assigning the weightage for every security parameter, the number and complexity of test scenarios are identified. The parametric method helps to identify the extent and distribution of data needed for test execution based on various scenarios.
Test bed implementation: In the cybersecurity testing of applications, the method for testing any security vulnerability should be logical with the use of computer processing. Then, access control can be categorized based on the type of stakeholder, namely, employees, consultants, and others.
Test report interpretation: After the identification of gaps post test execution, these need to be analyzed to suggest improvements. The test reports need to be thoroughly analyzed and validated. Efforts should be made to look beyond any misleading information by using a security-reporting tool. Once the analysis is over, a comprehensive list of security vulnerabilities is prepared and classified. At the same time, the security features working for the application are identified. Post-classification of vulnerabilities, they are mitigated and tested.
A parameterized method to internet application security testing helps to capture the security testing requirements and plan tests at various levels and for different components of the application. It can capture requirements that cannot otherwise be done using traditional means.
29