Software Security Testing
Need
to complete information management software security testing and want
practical suggestions to ensure rapid project delivery?
What is security testing?
The objective of information management security testing is to ensure that new solution does not violate security policy.
What is the scope of security testing?
Information management security testing will include some or all of the following tests:
- A firewall configuration settings, to ensure they have been installed and maintained correctly;
- System settings, to ensure they have been configured correctly to protect sensitive data;
- Data access mechanisms, to ensure that all stored personal data is protected from unauthorized access;
- Data transmission across open, public networks, to ensure that encryption mechanisms do not fail;
- Anti-virus verification, to ensure that software is used, and regularly updated;
- Software vulnerability testing to ensure that code was developed to ensure:
- Validation of all input (to prevent cross-site scripting, injection flaws, malicious file execution, etc.);
- Validation of proper error handling;
- Validation of secure cryptographic storage;
- Validation of secure communications; and
- Validation of proper role-based access control (RBAC).
- Data access, to ensure that sensitive data is only available on a business "need to know" basis;
- Data access, to ensure that access to sensitive corporate and customer data is controlled;
- Physical access, to ensure that physical access
restrictions, processes and mechanisms prevent unauthorized access to
sensitive areas;
- Access to network resources, to ensure that all audit/control and logging procedures work; and
- Database backup and restore processes, to ensure that
data protection and disaster recovery processes will function correctly
if needed.
Who is involved with security testing?
Security testing is usually the responsibility of a corporate security officer who relies on help from:
- System and network administrators;
- Database administrators;
- Production support staff;
- External agencies e.g. payment card industry (PCI) requires security certification to process credit card-holder data; and
- Security testing vendors e.g. Trustwave is a company
which helps corporations achieve PCI compliance with specialized
software and security vulnerability/penetration testing.
Is all that security testing required for each project?
The short answer is no--However, security testing is an on-going cycle
that requires constant attention depending upon the risk tolerance of
the corporation.
Some companies have modest security requirements and may not require
the same security levels as other companies processing sensitive
corporate or customer data such as credit card numbers.
Summary...
The
objective of information management software security testing is to
ensure that new solution does not violate security policy.
Security testing may be required as part of project quality assurance testing and may also be required on an
ongoing basis.
|
