Security Testing and Functional Testing

It’s not the primary job of a tester to find all the bugs in a product. Unless you have an extremely small product that runs on a very limited system, you won’t be able to find all the bugs unless you don’t plan on releasing the product for a very long time.

The primary job of a tester is not to get all bugs fixed either. There are always bugs that will remain unfixed as a conscious decision. Testers also do not generally make decisions on which bugs get fixed and which ones are deferred to a later date, or even those that there are no plans to fix.

The primary job of a tester is also not to decide when to ship a product. Although you can relay the state of the product to the company, the decision to release the product is typically made by the company or a team within the product group.

Functional testing is testing that is performed on behalf of a legitimate user of the product who is attempting to use it in the way it was intended to be used and for its intended purpose. This is who the functional tester is really the advocate for.The majority of functional testing is done from the viewpoint of a customer.

Testing from only customer viewpoint will cause you to bypass a large percentage of security tests. Most security vulnerabilities, although they have a chance of being discovered by the intended customers, are unlikely to be exploited by them.

The customer may call technical support to report the bug or maybe just grumble about it to friends or acquaintances. It’s unlikely that many of the intended customers will even recognize that bug as more than a nuisance or sign of poor quality, let alone correctly see it as a security risk.

The attention of functional testing is much more focused on how to enable the customers to perform their tasks in the easiest and most convenient way possible while providing enough checks and safety measures so that they can’t cause inadvertent harm too easily. It’s a sort of
“protect them from themselves” mentality.

If any security testing is done,it tends to focus on things such as permissions and privileges but, again,only based around the assumption that the customer is using something like the login functionality as intended.

In essence, because you are performing tests on behalf of a customer,you are trusting that all people using the software you are testing are customers and not merely consumers.

Customers are the people or organizations that your software is intentionally written to solve a problem or problems for. They have been the main focus throughout the entire development cycle, from the gathering of requirements through the implementation, and that then provides the basis for functional testing.

Customers are the people or organizations that your software is intentionally written to solve a problem or problems for. They have been the main focus throughout the entire development cycle, from the gathering of requirements through the implementation, and that then provides the basis for functional testing.

Consumers, on the other hand, are those people or organizations that might use your software in a way it was or was not intended and who are not included in your customers. Sometimes your product’s consumer base grows because your product is able to perform some task as part of its normal repertoire, and that task is all that the consumer wishes to accomplish.

Sometimes it is because your product interfaces with some other software or hardware, and the consumer wants to use that ability to interface to their own advantage or because they think it may be exploitable.

Related Posts

Software security vocabulary
TESTING CONSTRAINTS PART TWO

LIFE CYCLE TESTING

TEST METRICS

Independent Software Testing

Test Process

Testing verification and validation

Functional and structural testing

Static and dynamic testing

V model testing

Eleven steps of V model testing

Structural testing

Execution testing technique

Recovery Testing technique

Operation testing technique

Compliance software testing technique

Security testing technique

Software Security Vocabulary

Access Control List (ACL): A data structure or list that is maintained to track what users or groups have permissions to perform what actions.This is a Windows term.

Attack: A particular instance of an attempted introduction of one or more exploits to a system.

Attacker: Someone who is trying to bypass the security of one or more pieces of software to carry out his or her own agenda.

Back Door: A piece of malicious software that is installed and left running to provide a way for an attacker to regain system access at a later time.

Cracker: Someone who “cracks” through software security, particularly licensing and copy protection. It’s thought to have its roots in “safe cracker.” This term isn’t often used, in part because it’s more narrowly focused and in part because it’s just not as widely known, and the differentiation between a hacker and a cracker is not clear.

Cracking: The act of circumventing the copy protection, licensing, or registration functionality of software.

Daemon: A piece of software running in the background, usually as a process. Sometimes used interchangeably with “demon.”

Denial of Service (DoS): Where legitimate users are prevented from accessing services or resources they would normally be able to access.

Distributed Denial of Service (DDoS): Where legitimate users are prevented from accessing services or resources by a coordinated attack from multiple sources.

Escalation of Privilege: When attackers illegitimately gain more functionality or access than they are authorized to have.

Ethical Hacker: One that performs penetration tests. Sometimes ethical hackers are also called “white hats.”

Exploit: A code, technique, or program that takes advantage of a vulnerability to access an asset.

Firewall: An application or hardware appliance designed to diminish the chances of an attack by limiting specific types of information that can pass into or out of a system or network. It’s a piece of perimeter security.

Hacker: Someone who “hacks” together programs, i.e., writes them in a particularly haphazard or unorganized manner. This wasn’t originally a term that was specific to attackers, but in the last few years it has become an often-used synonym for attackers, especially in the press.

Hijacking: A situation when an attacker takes over control of one side of a two-sided conversation or connection.

Hub: A networking device that repeats the network packets on the physical network layer among many devices.

Information Disclosure: A situation when an attacker is able to access information he or she shouldn’t be able to.

Intrusion Detection System: An application that monitors a system or network and reports if it recognizes that the signs of an attack are present.

Leetspeek: The stereotypical sign of a script kiddie where text is written with numbers substituted for letters. The name comes from “elite.” For example, “leet” is often written as “1337” or “l33t.”

Media Access Control (MAC) Address: Also called the Physical Address, it is physically embedded in every network interface card (NIC) during the manufacturing process. MAC addresses are often treated as unique, although that is not actually guaranteed.

OSI Network Model/OSI Seven Layer Model: The Open Systems Interconnection Reference Model. This is commonly used to explain at what point certain processes are taking place and how information travels.

Personally Identifiable Information (PII): Information that is private to the user or machine. Disclosing PII is a violation of user privacy and can be a part of identity theft problems.

Phishing: Social engineering on a large scale, usually to obtain things like login information, credit card numbers, etc.

Protocal Stack: A system that implements protocol behavior based on a series of the OSI Network Model.

Reverse Engineering: The act of wholly or partially recreating the algorithms or designs used in software. This is usually done without sourcecode access.

Rootkit or Root Kit: A set of tools and scripts that an attacker installs after successfully compromising a system. These are designed to automate additional tasks including installing additional programs like key loggers, remote administration tools, packet sniffers, backdoors, etc. Kernel Rootkits are rootkits that hide themselves within the operating system’s kernel, making them a lot more difficult to detect.

Router:A hardware device that routes traffic between two networks. It can also disguise the traffic from the network behind it to make it appear as if all traffic comes from a single system.

Script kiddie: The somewhat derogatory term for an attacker who primarily downloads and uses exploit code designed and written by others. “Script kiddie” tends to be used to signify a Copy-cat type of attacker that is not particularly skilled or creative on his or her own. A script kiddie is also considered to be young, cocky, and brash.

Social Engineering: The process of tricking or convincing a user into volunteering information the hacker can later use. This is often focused on things that are either finance related or material for identity theft.

Spoofing: Impersonating someone or something else — such as another user or machine — in order to trick software security checks or users.

Switch: A hardware device similar to a hub but which knows the hardware (MAC) addresses of each machine connected to it. This is so it can transmit packets only to the individual machine it is addressed to.

Threat: A possible path to illegitimate access of an asset.

Trojan Horse: A piece of malicious software designed to deceive the victims by appearing to be a benign program that they may wish to use and thus are willing to download or install.

Virus: A piece of malicious software that is capable of spreading itself, typically as part of a piece of software or a file that is shared between users.

Vulnerability: A bug in the software that would allow an attacker to make use of a threat to illegitimately access an asset. All vulnerabilities are threats, but only unmitigated threats are vulnerabilities.

Zero-Day Exploit: A vulnerability that is exploited immediately after its discovery, often before the software company or the security community is aware of the vulnerability.

See proof techniques here

TESTING CONSTRAINTS PART TWO

LIFE CYCLE TESTING

TEST METRICS

Independent Software Testing

Test Process

Testing verification and validation

Functional and structural testing

Static and dynamic testing

V model testing

Eleven steps of V model testing

Structural testing

Execution testing technique

Recovery Testing technique

Operation testing technique

Compliance software testing technique

Security testing technique