System and Application Testing for Security Vulnerabilities (CSTP Elective) or (CTM Elective)

This tutorial covers the Elective area of the Test Management Body of Knowledge (TMBOK) required for the Certified Test Manager (CTM) certification. This tutorial also covers the Elective area of the Certified Software Test Professional requirements.

Concepts

This course focuses on Internet / Intranet security vulnerabilities and how to test for them.

Our businesses have moved to the Web, and with them our secrets, and our valuables. It shouldn't surprise anyone that hackers who were once content to cause mayhem with malicious viruses, now turn their knowledge towards making a profit. Last years' unprecedented number of viruses and blind attacks have been replaced by carefully coordinated custom tailored attacks that have breached some of our most “secure” systems and plundered businesses and government alike.

Would you recognize a security vulnerability in your system or application if you saw it? Hackers only need to find one way in. --Web Servers and the applications they host present a huge attack surface to hackers. Yet most test groups don't perform any security specific testing at all. This course teaches you what hackers do, and what you need to do to help prevent it.

This course brings you up to speed on today's security realities and shows you just how insecure our Internet/Intranet systems are. You will find out what hackers are doing, how they are doing it, and why, so you can prepare your software applications and systems for the war zone they have to survive. This course shows testers what to test for and how to test it to ensure their system is able to withstand current attack strategies and how to connect to ongoing information streams that will keep them on top of security vulnerabilities as they are discovered.

Outline

• Introduction
  • Today's Hackers are out for profit if you have something of value, beware
  • Case study: Step by step events from an actual successful attack
  • The Language of Security and The Mechanics of Security Breach
    • Attack Vectors
    • Attack Surfaces, Web servers, Portals, Database servers, APIs, and Web applications
    • How attackers use the Internet to gain access to your private networks
    • Attack Styles Diversions, Breaches, Infiltrations, Exploitations
    • Attack Purpose: Information Theft, Compromise, Recourse Diversion and Repurposing, Complete Destruction - Mahem
• What to test for and how to test it
  • Attack Surfaces in Software Systems and Architecture
    • Internet/ Intranet and Private Networks
    • Web Servers, Portal Servers, SQL Server
    • Applications:
      • Server side applications
      • Client side applications
  • Other Security Issues
• Automated Tools

Participants will learn:

• Identifying Security Targets and Attack Surfaces in applications and systems
• Tests for the most common types of security failures
• Staying informed about current Security Issues