Security testing is performed to ensure that the software is safe and secure by checking whether there is any information leakage in the sense by encrypting the application or using wide range of software's and hardware's and firewall etc. This testing makes sure that the software is not easily hacked by malicious codes and helps software developers to identify and remove loopholes in the software and to ensure that the system will not be attacked by hackers and other third party intruders.
Objective of Security Testing
The objective of security testing is to ensure that adequate attention is provided to identify the security risks, to ensure that a realistic mechanism to define and enforce access to the system is in place, to ensure that sufficient expertise exists to perform adequate security testing and to conduct reasonable tests to confirm the proper functioning of the implemented security measures.
Who should do the Security Testing?
During security testing, testers may need to use a risk-based approach and can easily focus on software security assurance by finding out risks in the systems and designing tests by those risks. Irrespective of the type of testing, the testing engineers plan and conduct security testing who should have significant security and networking related knowledge including expertise in network security, firewalls, intrusion detection system, operating systems, and programming and networking protocols like TCP/IP.
Types of Security Testing
There are different types of Security Testing. They are as follows:
Security Auditing:
Security Auditing means direct inspection of the application developed and Operating Systems and any system on which it is being developed. This also involves code walk-through. This test just looks at the overall hardware security and software security of the system.
Security Scanning:
Security scanning involves scanning and verification of the system and applications.
Vulnerability Scanning:
Vulnerability scanning involves scanning of the application for all known vulnerabilities including hosts and open ports and it also provides information on the associated vulnerabilities. This scanning is generally done through various vulnerability scanning software.
Risk Assessment:
Risk assessment is a method of analyzing and deciding the risk, which depends upon the type of loss and the possibility/probability of loss occurrence. It helps in finding out and preparing possible backup-plan for any type of potential risk, hence contributing towards the security conformance.
Ethical Hacking:
It is a forced intrusion of an external element into the system and applications that are under Security Testing. Ethical hacking involves number of penetration tests over the wide network on the system under test.
Posture Assessment and Security Testing: This is a combination of Security Scanning, Risk Assessment, and Ethical Hacking in order to reach a conclusive point and help your organization know its stand in context with Security.
Penetration Testing:
Penetration testing will give you an opportunity to make valid assessments to find out if the software is effective or not especially against hacking attempts. In this type of testing, a tester tries to forcibly access and enter the application under test. In the penetration testing, a tester may try to enter into the application/system with the help of some other application or with the help of combinations of loopholes that the application has kept open unknowingly. Penetration test is highly important as it is the most effective way to practically find out potential loopholes in the application. Penetration testing can be either black hat testing, internal pen test, or external pen test.
Software Security Concerns
Creating software is not similar to securing it with a firewall at a later stage. We must build it along with the development of software and inside it.
Building software safe and secure depends on three issues: People, technology, and process.
People should have sufficient skills and knowledge about how to test the software application and compose a report.
The people involved in the Process should know the procedures they must adapt to keep the software safe and effective.
Technology will ensure the effectiveness of the software's implementation. It will also use the necessary security features in the development framework.
The development framework should have the following activities to help thesoftware become more secure:
• Authentication.
• Session management.
• Authorization.
• Data validation.
• Data protection.
The conclusion is that securing applications can ensure system safety and security, which can impede attacks by hackers. This testing is the most important tests that we should conduct before introducing it to the commercial domain.
Saturday, 17 November 2012
Interview Questions on Agile Development Methodologies
1) What is Agile Development model and explain about different methodologies in Agile Software development?
Desired Skills and Capabilities for Testing Personnel in a Software Testing Team
Even though software testing is a specific profession many testers have had other careers before becoming testers. However, most of the testers, who have not started their career as testers, either had a background in development or in the domain of the product they happen to work with.
Past Background of Testers
There is a general belief that testers should be from a development background. However It is not necessarily so, but having a development background certainly helps. Knowledge of how software development is done provides valuable insight into what could cause errors and how faults can possibly be introduced.
Background of product domain too offers great help in a software-testing career. It facilitates the understanding of the requirements and the required test environment. Knowledge of the domain creates valuable credibility from the point of view of the users of the product. In fact it can be a good investment to provide testers without relevant domain knowledge with a feeling for where the product they are working on is going after it is released.
Capabilities of Software Testing Professionals
The yardstick for the measure of the capability of software testing professionals remain his/her experience and training in either or all the areas like that of being a user, in development or testing etc. Irrespective of being our position, our skills of dealing with people like convincing others, criticizing others or receiving criticism, influencing others and making negotiations are very important parts of the role of testing.
Software companies prefer to have a variety of personality types within their software testing team. The best combinations may be ensured at times of recruiting. Even if that is not possible, knowledge of certain patterns of behavior can help us enhance the team we are working with.
Individual Skills & Personalities:
Testing is a challenging profession. It requires certain skills and capabilities that individual testing practitioners ought to have. It also demands people with certain set of human characteristics or personality types.
Every person is born with certain set of personalities. Although peersonalities with which we are born are quite difficult to change, yet there are few personalities that get chiseled into us from then onwards.
I am giving below few common traits that will help software-testing engineers in their position as professional testers. Software testing profession demands that a tester must preferably have following basic abilities:
1) Intelligence: Because testing is a sort of intellectual activity.
2) Creativity: Because testing activity requires great deal of creativity for being effective.
3) Endurance: Because testing requires great tenacity against pressure & resistance & the activity needs be carried on despite many odds.
4) Systematic Working: Because testing activity must have a reliable coverage.
5) Pragmatic: Because testing activity involves great deal of sampling.
6) Good communication: Because testing involves many persons having their stake.
7) Good courage: Because testing is generally perceived to give unpleasant news.
8) Good Maturity: Because testing profession is quite demanding, hence needs good maturity.
Professional software testing engineers need to have training and experience in testing domain. Such training can be:
1) Education: Education either from an educational institution or in the form of courses in testing theory. The testers should learn to remember and understand test-related terms, concepts, and statements.
2) On-the-job training and mentoring: The testers should learn to apply their knowledge.
3) Carrying out of testing activities: The testers should learn to see structures and principles and divide the task into smaller tasks.
4) Experience exchange and further education: The testers should learn to combine and think in abstract terms.
Test Roles and Specific Skills:
Testing is not just one single activity. If we take a close look at the test process and all the tasks testers need to perform, we can see that there are a many different test roles as described below.
The testing roles can be defined as:
1) or a person responsible for testing functions
2) Test analyst / Test designer
3) Test executor
4) Test reviewer / inspector
5) Domain expert may be a user representative
6) Test or a person responsible for setting up the test environment
7) Test tool specialist or a person responsible for the test tool
Each of these roles requires specific skills and capabilities from the people engaged on these activities, apart from the general traits and skills required for all testers.
The following table described few important training & experience requirements:
Sr Testing Role Training or Experience Requirement 1 Test leader or manager # Test policy and strategies of the organization 2 Test analyst / Test designer # Analysis of requirements and other specifications # Design of test cases # Effective usage of test case design techniques # Building and documenting test procedures 3 Test executor Execution, recording, and checking tests 4 Test reviewer / inspector Static test techniques 5 Domain expert Basic test principles 6 Environment Expert # Platforms # Test database administration 7 Test tool expert # Platforms # Specific tools
# Testing standards
# Test management: estimation, planning, monitoring, control, reporting & managing people
Software Testing by Other Professionals:
Even though software testing is a full-fledged profession in itself, yet people from other professions can also participate and contribute in the performance of the testing activities.
Users too can be very good testers. This applies to both future users of the new product and actual users of similar products or earlier versions of the product. The users obviously see the product from the user's perspective. Users have ideas about the future use of the product, that is helpful in providing an insight into where failures would have the greatest impact for example it can offer useful inputs to the risk management.
Users are best involved in requirements' analysis – which remains the starting point. Users can also be extremely useful in the test, even if he/she does not have an in-depth knowledge of the domain.
Developers can be good testers. They know how difficult requirements analysis is, how difficult design is, and how difficult coding is, and this means that they have insight into where errors may have been made, and hence where the faults may be.
Developers are best involved in static testing. They can also contribute in dynamic testing, not least in component testing and component integration testing.
Requirement of Interpersonal Skills:
Interpersonal skills are important in the roles of testing. Testers need to have ability to:
1) Provide constructive criticism and receive criticism
2) Influence people
3) Do negotiations
Providing constructive criticism is very difficult for most of the people. No professional ever wishes to hurt others - most of the people prefer to have peace with others instead of blaming & pointing out failures.
Again we need to consider what testing is. It may be seen as a destructive activity, since the tester has to find and register failures. However, registration of failures is not criticizing the developer. Testing is a very constructive development activity. It makes useful contribution to the possibility of everybody reaching the common goal of delivering a product of a good quality, learn, and becoming even better in the future.
Testers do however have to give criticism from time to time. The basic rules for doing this are:
1) Stay calm
2) Keep focussed to the facts
3) Never blame
4) Keep an open mind, as you too could be wrong.
Receiving criticism is just as difficult as providing it. We feel threatened, and some of our needs like respect, recognition, and security appear to be at stake.
Testers do however have to take criticism from time to time if we want to get better at our job. The basic rules for bearing criticism are:
1) Listen carefully for the smallest piece of truth
2) Whenever in doubt, ask for clarification of views and goals
3) When you find that the criticism is genuine, have courage to admit to it frankly, otherwise you will loose your credibility.
Testing involves interaction with many other developments and supporting activities. Here the tester remains dependent on the decisions and schedules of other people.
Generally testers find themselves with a feeling that they are being victimized. They find themselves in impossible situations, and they don't do much about it because: "This is just the way things are!" There is no reason for bending under this "law of necessity." In fact testers can usually influence more than they think - especially if they start early.
Some of the areas, where testers are dependent on others, but where they can also use their influence, are:
1) Delivery order: By asking and explaining why
2) Delivery quality: By defining entry criteria
3) Delivery date: By negotiating with other managers
4) Planning of test activities: By talking to other managers
5) Allocation of resources: By negotiation with management
6) Classification of failures: By using a scheme
7) Training: By asking and participating
8) Process improvement: By contributing and participating
When we assert our influence on other people it is useful to remember that demands create resentment, while requests for help usually create kindheartedness.
Like in all other communication we need to listen first and then talk. When we listen we must listen for reasons, goals, fears, and threats from the other party's point of view. And when we talk, we most of all have to explain. We have to explain our reasons, goals, fears, and threats.
Most of the time we can come to an agreement simply by talking and explaining our needs and constraints to each other.
However, sometimes we get into a situation where we have to negotiate, that is, to engage in bargaining to reach agreement.
A few basic rules about negotiations are:
1) Look behind the positions to the real interests
2) Work with best alternative to a negotiated agreement
3) Walk away if negotiation is going nowhere
4) Identify options as parts of the solution
5) Go for a win-win solution
6) Aim at an atmosphere of common problem solution
Conclusion: For being a Good Software Testing Professional, following ten traits are quite essential
1) Be an explorer & don't be afraid to venture into the unknown.
2) Be a trouble shooter having ability to diagnose if something doesn't work.
3) Be relentless & keep trying, don't rule out any failure for being a fluke.
4) Be creative & adventure with an off-the-wall approach.
5) Try to achieve perfection if not cent per cent, at least close to it.
6) Try to exercise best judgment as to a) What to test? b) How long to test? & c) Whether it is truly a bug?
7) Be tactful & diplomatic with courage to tell the developers that their code is really bad.
8) Be persuasive with an ability to convince others on your point especially on the reason why a bug needs to be fixed.
9) Try to do many things as per the pre defined plans & not on the spur of the moment.
9) Assign different tasks to the team members according to their skills & preferences.
10) Maximize diversity of your team to reach more beneficial conclusions & in turn better decisions.
Test Data Effectiveness in Bug Catching
In this write up we would talk about the need for effective test data, re-using test data over time ensuring they have not been corrupted and how test data should take into account: positive, negative, blank and boundary values to ensure they adequately test the application.
In addition to all of these, in my opinion it is very important to focus on your test data generation, depending on the type of testing undertaken. If you see, for functional testing you want a variety of test data covering all the points we mentioned above.
For performance testing too, the same will hold good, but when you scale and increase your load, you would want to ensure that you maintain diversity in your data even when you deal with volumes. For security testing, focus more on the negative data sets or rather illegal ones which you would not expect your regular users to use. Scripts, SQL statements are largely used here like how a hacker would, to gain access to the internals of the application. In case of localization testing, the tester is focusing on creating real time locale specific inputs for which he might have to use translator tools.
The tester will need to pay special attention around the currency, date/time formats, text length, etc. for the test data that he creates here. Prior to localization testing, when globalization and pseudo localization testing are done; the tester is focused more on creating gibberish or garbage data which is non-English to start off with. In cases ofaccessibility and usability testing, the tester is more focused on using tools like screen readers, narrators rather than focusing a lot on actual test data.
For data base testing scenarios, you may not only need test data but also have them populated into the database, for ease of access. So, if you try to see a pattern here, you are really customizing your test data depending on the type of testing you undertake with a goal of finding as many bugs as possible. Since test data creation takes a lot of time, it is a good idea to use tools wherever possible with of course due diligence done by the tester to ensure the validity of such automated test data that is created. Especially for scenarios such as user account and password creations where typically a huge volume of data is needed, a lot of freeware tools are available.
For every test pass, it would help to take care of the following checklist:
1. Understand the focus of the test pass and decide what tests are required
2. Evaluate to see what existing data can be reused
3. Ensure validity of such existing data
4. Analyze gaps for any new data that needs to be created
5. Analyze the data sources (whether data exists in XMLs, local files, data bases, reside in another application etc.) and see if any migrations are needed
Like test case maintenance effort, test data maintenance is a good practice to take on between test passes. The tester can look at any new tools in the market that can be used, any test data clean up that is needed, any new data that can be created, any user inputs from the field / bugs they have filed for which test data is very unique that you can add it to your data repertoire etc. Such pro-active tasks go a long way in saving you time and effort in your subsequent test passes and more importantly help you find realistic and good bugs. At certain times, you as a tester will also be required to share your test data with other teams in the product group including your development team to help them reproduce issues.
Similarly when bug bashes are held, to save time for everyone, along with the basic instructions some test data might also come in handy for the group to use. That said, you need to draw your balance here in how much test data you share with your team, because the test data goes a long way in finding some core bugs; so you would not want to impact the teams creativity and limit the bugs they find by sharing all of your test data.
So, chalk yourself a plan on how and what kind of data you want to generate, use and share with a goal of enhancing your product quality and containing defects as much as you can before product release.
Happy testing!
In addition to all of these, in my opinion it is very important to focus on your test data generation, depending on the type of testing undertaken. If you see, for functional testing you want a variety of test data covering all the points we mentioned above.
For performance testing too, the same will hold good, but when you scale and increase your load, you would want to ensure that you maintain diversity in your data even when you deal with volumes. For security testing, focus more on the negative data sets or rather illegal ones which you would not expect your regular users to use. Scripts, SQL statements are largely used here like how a hacker would, to gain access to the internals of the application. In case of localization testing, the tester is focusing on creating real time locale specific inputs for which he might have to use translator tools.
The tester will need to pay special attention around the currency, date/time formats, text length, etc. for the test data that he creates here. Prior to localization testing, when globalization and pseudo localization testing are done; the tester is focused more on creating gibberish or garbage data which is non-English to start off with. In cases ofaccessibility and usability testing, the tester is more focused on using tools like screen readers, narrators rather than focusing a lot on actual test data.
For data base testing scenarios, you may not only need test data but also have them populated into the database, for ease of access. So, if you try to see a pattern here, you are really customizing your test data depending on the type of testing you undertake with a goal of finding as many bugs as possible. Since test data creation takes a lot of time, it is a good idea to use tools wherever possible with of course due diligence done by the tester to ensure the validity of such automated test data that is created. Especially for scenarios such as user account and password creations where typically a huge volume of data is needed, a lot of freeware tools are available.
For every test pass, it would help to take care of the following checklist:
1. Understand the focus of the test pass and decide what tests are required
2. Evaluate to see what existing data can be reused
3. Ensure validity of such existing data
4. Analyze gaps for any new data that needs to be created
5. Analyze the data sources (whether data exists in XMLs, local files, data bases, reside in another application etc.) and see if any migrations are needed
Like test case maintenance effort, test data maintenance is a good practice to take on between test passes. The tester can look at any new tools in the market that can be used, any test data clean up that is needed, any new data that can be created, any user inputs from the field / bugs they have filed for which test data is very unique that you can add it to your data repertoire etc. Such pro-active tasks go a long way in saving you time and effort in your subsequent test passes and more importantly help you find realistic and good bugs. At certain times, you as a tester will also be required to share your test data with other teams in the product group including your development team to help them reproduce issues.
Similarly when bug bashes are held, to save time for everyone, along with the basic instructions some test data might also come in handy for the group to use. That said, you need to draw your balance here in how much test data you share with your team, because the test data goes a long way in finding some core bugs; so you would not want to impact the teams creativity and limit the bugs they find by sharing all of your test data.
So, chalk yourself a plan on how and what kind of data you want to generate, use and share with a goal of enhancing your product quality and containing defects as much as you can before product release.
Happy testing!
Subscribe to:
Posts (Atom)