Bug Blog

The first step is to test isolated interfaces, where file systems and networks may be vulnerable. These are usually the first place where hackers look for access through backdoors. This doesn’t mean that API should be neglected, it’s just that non-public inputs are always more numerous and are, on average, more likely to provide stealth entry.

It’s also important to move beyond functional testing and look for functions that are not included in documentation.  These can arise from the implicate order generated by the coding itself. Vulnerabilities can be found by looking at where the application is doing something that it isn’t intended to be doing and exhibiting unexpected behavior that might provide unauthorized access.

Static analysis is also a vital part of security testing. Code reviews should be frequent, but there is no substitute for static analysis tools that look through the code in greater detail to find areas that human beings may have missed.

Dynamic analysis is also a vital element of security testing. Security analysis is done while the program is running in order to reveal security flaws that cannot be found during static analysis. And the environment in which the application will be deployed should also be tested. Servers should be checked for security. Look over the configuration files and check for open ports. This will help protect critical files and directories.

Penetration tests are also a good idea. The human mind is incredibly imaginative and is the best hacking tool there is. Human beings may find ways in that no automation could have revealed. So, run penetration tests whenever feasible. There is no other way of testing for how hard or easy it is for someone to think their way into an application.

No application can be made completely secure, so it is vital to have response procedures in place in case of a breach of security. This requires the use of breach simulations to test how quickly and effectively problems can be fixed and data can be safeguarded. Perhaps the most important thing to remember about security testing is that it is an ongoing process. Like all forms of software testing, it is a dynamic activity that requires both automation and human activity and is an important element in configuration management.