This slide is an introduction to security testing

1. Introduction to
Security Testing
Prepared By
Rajakrishnan Sadasivan, MCA MBA PMP CSM ITIL ISTQB(Advanced)

2. What is Security Testing
• Security testing is a process intended to reveal flaws in the security
mechanisms of an information system that protect data and maintain
functionality as intended. (Wikipedia).
• Security Testing is the process of identifying the vulnerabilities and
use that vulnerability to penetrate to the application to identify the
impact of it.

3. Elements of Security Testing
Confidentiality disclosure of information to parties other than the
intended recipient
Integrity protecting information from being modified by
unauthorized parties
Authentication It involves confirming the identity of a person
Availability Information must be kept available to authorized
persons when they need it.
Authorisation The process of determining that a requester is allowed
to receive a service or perform an operation
Ex: Access Control/Roles
Non-reputation Non-repudiation is a way to guarantee that the
sender of a message cannot later deny having sent the
message and that the recipient cannot deny having
received the message.

4. Security Testing Process
Analysis &
Planning
Vulnerability
Scanning
Vulnerability
Assessment
Penetration
(Attack)
Test Report
*Source: Created by Raj

5. Security Testing Process
Process Description
Analysis and Planning It is the phase where the security tester/Organisation
gather information about the items under test such as
application, Infrastructure, company security policy
etc.
A security test plan will be derived based on the
analysis
Vulnerability Scanning Vulnerability scanning will be done to identify the
vulnerable points both application level and network
level
Vulnerability Assessment Vulnerability Assessment will be performed based on
the vulnerability scanning result to summaries the
possible vulnerable areas
Penetration (Attack) Security tester tries to penetrate through the
vulnerable points to identify the impact of it
Test Report Penetration test report will be generated

6. Types of Security Testing
• Static Application Security Testing(SAST)
• SAST includes application security testing to identify the vulnerabilities of the application and test the impact of such vulnerabilities by trying to penetrate through those
vulnerabilities in code level
• It is usually done by developers
• It is done with Open source Or commercial tools
• Dynamic Application Security Testing (DAST)
• DAST includes application security testing to identify the vulnerabilities of the application and test the impact of such vulnerabilities by trying to penetrate through those
vulnerabilities
• It is usually done from inside the network
• It is done with Open source Or commercial tools
• Penetration Testing(PEN)
• Penetration testing typically includes network penetration testing and application security testing as well as controls and processes around the networks and
applications
• It is more comprehensive than DAST
• It is done both from inside and outside the network
• It is mostly done with powerful commercial tools
• Vulnerability Assessment vs PEN Testing
• A vulnerability assessment simply identifies and reports noted vulnerabilities, whereas a penetration test attempts to exploit the vulnerabilities to determine whether
unauthorized access or other malicious activity is possible.

7. Best Practices
• Security testing will be conducted in an isolated environment which is
similar to production environment setup
• Testing to be conducted from both internal and external networks
• Database backups to be taken before PEN TEST starts

8. OWASP
• Open Web Application Security Project(OWASP)
• The Open Web Application Security Project (OWASP) is
a 501(c)(3) worldwide not-for-profit charitable organization focused
on improving the security of software
• It is an online community, produces freely-available articles,
methodologies, documentation, tools, and technologies in the field
of web application security
• OWASP Top Ten regularly published every year which list the top 10
vulnerabilities for the web application

9. OWASP TOP 10- 2018
Top 10 Description
Injection Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted
data is sent to an interpreter as part of a command or query. The attacker’s hostile
data can trick the interpreter into executing unintended commands or accessing
data without proper authorization.
Broken Authentication Application functions related to authentication and session management are often
implemented incorrectly, allowing attackers to compromise passwords, keys, or
session tokens, or to exploit other implementation flaws to assume other users’
identities temporarily or permanently.
Sensitive Data Exposure Many web applications and APIs do not properly protect sensitive data, such as
financial, healthcare, and PII. Attackers may steal or modify such weakly protected
data to conduct credit card fraud, identity theft, or other crimes.
Insufficient Logging & Monitoring Insufficient logging and monitoring, coupled with missing or ineffective integration
with incident response, allows attackers to further attack systems, maintain
persistence, pivot to more systems, and tamper, extract, or destroy data.
Broken Access Control Restrictions on what authenticated users are allowed to do are often not properly
enforced. Attackers can exploit these flaws to access unauthorized functionality
and/or data, such as access other users' accounts, view sensitive files, modify other
users’ data, change access rights, etc.

10. OWASP TOP 10- 2018
Top 10 Description
Security Misconfiguration Security misconfiguration is the most commonly seen issue. This is commonly a
result of insecure default configurations, incomplete or ad hoc configurations,
open cloud storage, misconfigured HTTP headers, and verbose error messages
containing sensitive information. Not only must all operating systems, frameworks,
libraries, and applications be securely configured, but they must be patched and
upgraded in a timely fashion.
Cross-Site Scripting (XSS) XSS flaws occur whenever an application includes untrusted data in a new web
page without proper validation or escaping, or updates an existing web page with
user-supplied data using a browser API that can create HTML or JavaScript. XSS
allows attackers to execute scripts in the victim’s browser which can hijack user
sessions, deface web sites, or redirect the user to malicious sites.
Insecure Deserialization Insecure deserialization often leads to remote code execution
Using Components with Known Vulnerabilities Components, such as libraries, frameworks, and other software modules, run with
the same privileges as the application. Applications and APIs using components
with known vulnerabilities may undermine application defenses and enable
various attacks and impacts.
Insufficient Logging & Monitoring Insufficient logging and monitoring, coupled with missing or ineffective integration
with incident response, allows attackers to further attack systems, maintain
persistence, pivot to more systems, and tamper, extract, or destroy data.

11. Security Testing Tools
• Open source Tools
• DAST
• OWASP ZAP
• https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
• SAST
• SonarQube
• https://www.owasp.org/index.php/OWASP_SonarQube_Project
• Reference
• https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools

12. References
• www.Wikipedia.org
• https://www.veracode.com
• https://www.owasp.org/index.php/Main_Page
• https://www.owasp.org/index.php/Category:Vulnerability_Scanning_
Tools
• https://www.owasp.org/images/7/72/OWASP_Top_10-
2017_%28en%29.pdf.pdf