Security Testing - Final Release Security Issues

GeekInterview.com > Interview Questions > Testing > Security Testing

Go To First | Previous Question | Next Question

Security Testing | Question 7 of 11

Final Release Security Issues

How will you find security issues present in the final release of the application. What are the checklist for Security Testing?

Total Answers and Comments: 2

Last Update: August 08, 2009 Asked by: mathan_vel

Sponsored Links

Best Rated Answer

—

Submitted by: srinivasulub1981

1.1 LOAD

1.1.1 Many users requesting a certain page at the same time or using the site simultaneously
1.1.2 Increase the number of users and keep the data constant
1.1.3 Does the home page load quickly? within 8 seconds
1.1.4 Is load time appropriate to content, even on a slow dial-in connection?
1.1.5 Can the site sustain long periods of usage by multiple users?
1.1.6 Can the site sustain long periods of continuous usage by 1 user?
1.1.7 Is page loading performance acceptable over modems of different speeds?
1.1.8 Does the system meet its goals for response time, throughput, and availability?
1.1.9 Have you defined standards for response time (i.e. all screens should paint within 10 seconds)?
1.1.10 Does the system operate in the same way across different computer and network configurations, platforms and environments, with different mixes of other applications?

1.2 VOLUME

1.2.1 Increase the data by having constant users
1.2.2 Will the site allow for large orders without locking out inventory if the transaction is invalid?
1.2.3 Can the site sustain large transactions without crashing?

1.3 STRESS

1.3.1 Increase both number of users and the data
1.3.2 Performance of memory, CPU, file handling etc.
1.3.3 Error in software, hardware, memory errors (leakage, overwrite or pointers)
1.3.4 Is the application or certain features going to be used only during certain periods of time or will it be used continuously 24 hours a day 7 days a week? Test that the application is able to perform during those conditions. Will downtime be allowed or is that out of the question?
1.3.5 Verify that the application is able to meet the requirements and does not run out of memory or disk space.

1.4 SECURITY

1.4.1 Is confidentiality/user privacy protected?
1.4.2 Does the site prompt for user name and password?
1.4.3 Are there Digital Certificates, both at server and client?
1.4.4 Have you verified where encryption begins and ends?
1.4.5 Are concurrent log-ons permitted?
1.4.6 Does the application include time-outs due to inactivity?
1.4.7 Is bookmarking disabled on secure pages?
1.4.8 Does the key/lock display on status bar for insecure/secure pages?
1.4.9 Is Right Click, View, Source disabled?
1.4.10 Are you prevented from doing direct searches by editing content in the URL?
1.4.11 If using Digital Certificates, test the browser Cache by enrolling for the Certificate and completing all of the required security information. After completing the application and installation of the certificate, try using the <-- BackSpace key to see if that security information is still residing in Cache. If it is, then any user could walk up to the PC and access highly sensitive Digital Certificate security information.
1.4.12 Is there an alternative way to access secure pages for browsers under version 3.0, since SSL is not compatible with those browsers?
1.4.13 Do your users know when they are entering or leaving secure portions of your site?
1.4.14 Does your server lock out an individual who has tried to access your site multiple times with invalid login/password information?
1.4.15 Test both valid and invalid login names and passwords. Are they case sensitive? Is there a limit to how many tries that are allowed? Can it be bypassed by typing the URL to a page inside directly in the browser?
1.4.16 What happens whentime out is exceeded? Are users still able to navigate through the site?
1.4.17 Relevant information is written to the logfiles and that the information is traceable.
1.4.18 In SSL verify that the encryption is done correctly and check the integrity of the information.
1.4.19 Scripting on the server is not possible to plan or edit scripts without authorisation.
1.4.20 Have you tested the impact of Secure Proxy Server?
1.4.21 Test should be done to ensure that the Load Balancing Server is taking the session information of Server A and pooling it to Server B when A goes down.
1.4.22 Have you verified the use of 128-bit Encryption?

Above answer was rated as good by the following members:
goksn

May 06, 2009 06:44:48

srinivasulub1981

Member Since: December 2005 Contribution: 381

RE: Final Release Security Issues

1.1 LOAD

1.1.1 Many users requesting a certain page at the same time or using the site simultaneously
1.1.2 Increase the number of users and keep the data constant
1.1.3 Does the home page load quickly? within 8 seconds
1.1.4 Is load time appropriate to content even on a slow dial-in connection?
1.1.5 Can the site sustain long periods of usage by multiple users?
1.1.6 Can the site sustain long periods of continuous usage by 1 user?
1.1.7 Is page loading performance acceptable over modems of different speeds?
1.1.8 Does the system meet its goals for response time throughput and availability?
1.1.9 Have you defined standards for response time (i.e. all screens should paint within 10 seconds)?
1.1.10 Does the system operate in the same way across different computer and network configurations platforms and environments with different mixes of other applications?

1.2 VOLUME

1.2.1 Increase the data by having constant users
1.2.2 Will the site allow for large orders without locking out inventory if the transaction is invalid?
1.2.3 Can the site sustain large transactions without crashing?

1.3 STRESS

1.3.1 Increase both number of users and the data
1.3.2 Performance of memory CPU file handling etc.
1.3.3 Error in software hardware memory errors (leakage overwrite or pointers)
1.3.4 Is the application or certain features going to be used only during certain periods of time or will it be used continuously 24 hours a day 7 days a week? Test that the application is able to perform during those conditions. Will downtime be allowed or is that out of the question?
1.3.5 Verify that the application is able to meet the requirements and does not run out of memory or disk space.

1.4 SECURITY

1.4.1 Is confidentiality/user privacy protected?
1.4.2 Does the site prompt for user name and password?
1.4.3 Are there Digital Certificates both at server and client?
1.4.4 Have you verified where encryption begins and ends?
1.4.5 Are concurrent log-ons permitted?
1.4.6 Does the application include time-outs due to inactivity?
1.4.7 Is bookmarking disabled on secure pages?
1.4.8 Does the key/lock display on status bar for insecure/secure pages?
1.4.9 Is Right Click View Source disabled?
1.4.10 Are you prevented from doing direct searches by editing content in the URL?
1.4.11 If using Digital Certificates test the browser Cache by enrolling for the Certificate and completing all of the required security information. After completing the application and installation of the certificate try using the <-- BackSpace key to see if that security information is still residing in Cache. If it is then any user could walk up to the PC and access highly sensitive Digital Certificate security information.
1.4.12 Is there an alternative way to access secure pages for browsers under version 3.0 since SSL is not compatible with those browsers?
1.4.13 Do your users know when they are entering or leaving secure portions of your site?
1.4.14 Does your server lock out an individual who has tried to access your site multiple times with invalid login/password information?
1.4.15 Test both valid and invalid login names and passwords. Are they case sensitive? Is there a limit to how many tries that are allowed? Can it be bypassed by typing the URL to a page inside directly in the browser?
1.4.16 What happens whentime out is exceeded? Are users still able to navigate through the site?
1.4.17 Relevant information is written to the logfiles and that the information is traceable.
1.4.18 In SSL verify that the encryption is done correctly and check the integrity of the information.
1.4.19 Scripting on the server is not possible to plan or edit scripts without authorisation.
1.4.20 Have you tested the impact of Secure Proxy Server?
1.4.21 Test should be done to ensure that the Load Balancing Server is taking the session information of Server A and pooling it to Server B when A goes down.
1.4.22 Have you verified the use of 128-bit Encryption?

Is this answer useful? Yes | No

1 0

Overall Rating: +1

August 08, 2009 03:29:55

saravanan123

Member Since: July 2009 Contribution: 163

RE: Final Release Security Issues

Final Release security issues is nothing but when the software is ready to release all the testing has been completed at last they will test how the security function is workingon to it.

Is this answer useful? Yes | No

Identifying SQA Issues

Identifying SQA Issues Software Quality Assurance is a good practice that every large scale business should employ IT related businesses have never hesitated to use SQA to ensure that the application they will release for their users or sell to their customers will live up to their expectations Iden

Security enhancements in SQL Server 2005

The trustworthy computing initiative has contributed greatly to help microsoft improve customer experience. A number of customer needs on security have been addressed. 1. Restricting user access to sql server 2. Disabling services and restricting service configuration 3. Reducing the surface are aof

ITIL Security Management

What is ITIL Security Management? The process of ITIL Security Management describes the structure model of security in the management organization. It is based on the Code of Practice for Information Security Management that is also often known as ISO/IEC 17799. Security Management is basically inf

Testing and Integration

Once the software is complete, it will go though rigorous testing before its actual integration.  In this article we will take a look at different types of software testing and also different types of integration. With the diversity of business setting and software development models, it al

The Interview Snafu

How to turn someone else’s mistake to your advantage Your dream job is about to become reality. A recruiter gave you the heads up about the perfect position at Humungous Conglomerate, Inc. You went through five interviews as well as a battery of psychological tests mandated by their HR de

Effective Controls for Attaining Continuous Application Security

Effective Controls for Attaining Continuous Application Security Throughout the Web Application Development Life Cycle Given the choice, every organization would want secure Web sites and applications from the Web application development phase all the way through the software development life cycle.

Winning a Job Interview with a Winning Resume

Does your resume unlock your potential, take your skills to the highest level and win you the interview and the job you want now? The job market today is highly competitive and even if you think you have what it takes to get an interview you won’t get over the line without a polished, prof

Top 10 Application Security Vulnerabilities in Web.config Files - Part One

These days, the biggest threat to an network security comes from its public Web site and the Web-based applications found there. Unlike internal-only network services such as databases-which can be sealed off from the outside via firewalls-a public Web site is generally accessible to anyone who wan

Top 10 Application Security Vulnerabilities in Web.config Files - Part Two

Some of the most common and dangerous application security vulnerabilities that exist in ASP.NET Web-based applications come not from the C# or VB.NET code that make up its pages and service methods, but instead from the XML code that makes up its Web.config files. Incorrect configurations can open

Security and IT Certification

Learning about different types of IT Certification is the first step to becoming successful with different types of technology. IT Certification is first divided into different groups.  Each of these groups will have certain focuses in relation to technology and how it can be used.&nbsp

Related Categories

—

User Name		Remember Me?
Password

Question Bank