Non Functional Testing

Main goals of security testing

Identify assets Things that need to be protected, such as software applications and computing infrastructure.

Identify threats and vulnerabilities : activities that can cause damage to an asset, or weaknesses in one or more assets that can be exploited by attackers.

Identify risk : security testing aims to evaluate the risk that specific threats or vulnerabilities will cause a negative impact to the business. Risk is evaluated by identifying the severity of a threat or vulnerability, and the likelihood and impact of exploitation.

Perform remediation : security testing is not just a passive evaluation of assets. It provides actionable guidance for remediating vulnerabilities discovered, and can verify that vulnerabilities were successfully fixed.

Key principles of security testing

Security testing aims to ensure that an organization’s systems, applications, and data upholds the following security principles:

Confidentiality – limiting access to sensitive access managed by a system.

Integrity – ensuring that data is consistent, accurate, and trustworthy throughout its lifecycle and cannot be modified by unauthorized entities.

Authentication – ensuring sensitive systems or data are protected by a mechanism that verifies the identity of the individual accessing them.

Authorization – ensuring sensitive systems or data properly control access for authenticated users according to their roles or permissions.

Availability – ensuring that critical systems or data are available for their users when they are needed.

What tools do we use for Wireless Security?

WIDS/WIPS: Wireless Intrusion detection & prevention System. In WIDS, a system of sensors is used to monitor the network for the intrusion of unauthorized devices, such as rogue access points. In a WIPS, the system not only detects unauthorized devices, but also takes steps to mitigate the threat by containing the device and detaching it from the wireless network

Postman : Using the Postman tool, we can analyze RESTful APIs made by others. Postman is an API(application programming interface) development tool that helps to build, test, and modify APIs. It has the ability to make various types of HTTP requests (POST, GET, PUT, PATCH, Delete)

Burp Tool: A Burp Suite is used to perform security tests for mobile applications via Burp Proxy. This enables us to intercept, view, and modify all the HTTP/S requests and responses processed by the app, and carry out penetration testing using Burp in the normal way

Nessus tool : Nessus is a remote security scanning tool, which scans a computer and raises an alert if it discovers any vulnerabilities that malicious hackers could use to gain access to any computer you have connected to a network. It does this by running over 1200 checks on a given computer, testing to see if any of these attacks could be used to break into the computer or otherwise harm it.

Ostinato: Ostinato: