Page 67

Brute-Force Attack This technique is often done by different software tools. The main idea of it is that the system is trying to get a password match using the valid ID by attempting to login again and again. The most common example of the security technique against this kind of attack is account blocking for some period of time. This is used by such mailing services as Yahoo! or Hotmail. The user has a number of consecutive attempts (mostly 3 ones) to login the account. If these attempts fail, the system blocks the account for a while (the time of blocking varies from 30 minutes to 24 hours). How to test: The first thing to do is to verify if the mechanism of account suspension is valid and working good. It is simple to check: the tester must try to login the account with invalid user IDs or passwords to make sure that the application successfully blocks the account which is being attempted to login with invalid registration data. If so, the application is secure about any kind of brute-force attack. In other case, there is a security vulnerability that must be reported. The security aspects described below and also the ones we were talking about in the first part of the article should be taken both for web and desktop apps. The following aspects are related only to web applications. SQL Injection And Cross Site Scripting (XSS) These are the names of two similar hacking attempts, so we are going to discuss them together. The thing is that malicious scripts are often used by hackers for manipulating the website. That’s why if you want your site to be secure, you need some ways to immune against such problems. Actually, there are several ones. First, all the input fields must be limited by the number of symbols in order to prevent the attempts of inputting any script there. For example you should limit the field “Last Name” by 30 symbols, but not 255. Objectively there are some fields where large information input is  needed. For such kind of fields the data should be checked and validated before it is saved in the application. Besides in such fields any HTML or script tags should be disallowed. Moreover, in order to prevent XSS attacks, the system should reject any script redirects from all the untrusted and unknown apps. How to test:The first thing to do is to get sure that all the lengths of all the fields are limited and implemented. Also the tester must get sure that defined length strikes off any script or tag input. Each of these aspects are easy ...

If you ever wanted to make any professional usability tester a bit scared, you may just ask him one single question: “Don’t you think that usability testing is subjective?”. The art and special science of usability testing is really complicated, that’s why there is so many opinions about the answer the question performed above. To understand this we have to learn some deeper aspects of usability testing. Below we represent some highlights on each of the opposite points of view about usability testing entity. One set of highlights is from people who is not a professional at all and the other – from professionals who really breaths usability testing every single day. Yes – mostly usability testing is a subjective thing Usability is mostly about visual design stuff which is very subjective thing. It’s a matter of taste for font size and styles, colors and so on. Usability is related to interaction design. It entails the evaluation of several ways to solve working problems. All that is needed is to provide simple user guides for proper use of the software. Usability is about my own thinking. This is a top of the subjectivity. No – usability testing can’t be considered as subjective thing: Of course usability contains the elements of visual design, but it’s not limited by this. For example, while colors and font size can really be subjective, the elements layout on the page is not so subjective and guided by the rules of usability. Of course usability entails information architecture and interaction design that are not subjective. It’s very important, what is the structure, division of content, how the user gets from one destination to another, how easy it is, what elements type is used. It’s simple to check the usability by letting someone to use the product for the first time. All the functions have to be intuitive and easy to use. Usability is not about what the usability expert thinks. It’s about what end users think. To request a quote for software testing services visit BugHuntress website.

Application Access It doesn’t matter if it is website of desktop application – all the options in access security are implemented by “Roles and Rights Management”. This is often has to be done implicitly when covering functionality: for example, the receptionist in the hospital is hardly concerned about the medical tests in the lab because his job is to register patients appointments. That’s why he has no access to the menus, forms and other information related to lab tests as his Role in the Hospital Management System is “Receptionist”. How to test the access security? When testing this point of the security options all of the Roles should be checked. Tester should create the accounts with all possible Roles. Then he needs to use all of these accounts in order to be sure that every role has an access only to its own forms, menus and screens. If any access conflict is found, this issue should be logged with complete security. Data Protection There are three main aspects in data security. The first one is: the particular user should view or utilize only the data he is supposed to view and use. This option is also provided by roles and rights, for example the company’s telesales manager can only view the data about the available stock, but he doesn’t have any access to the information about how much raw materials was bought for production. Testing technique of this aspect has been already explained above. The second aspect is about how the data is stored in the database. You should understand that all the data which is sensitive must be encrypted in order to make it secure. Especially encryption should be very strong for such an important and sensitive data like passwords to user accounts, numbers of credit cards and other business information. The third aspect is actually an extension of the second one. It is related to the information flows. When the flow of the sensitive data described above occurs in the application, the proper security level must be provided. It doesn’t matter if the information flow is between different modules of the application of between different apps, the data must be safely encrypted in order to protect it. It’s not actually necessary to say that all the above aspects should be properly tested before using the application. First, the tester should query the DB for passwords to user accounts, clients billing info and other sensitive data. Then he should verify that all this data is thoroughly encrypted being stored ...

Nowadays, most of individuals and institutions find it difficult to distinguish between quality assurance (QA), quality control (QC), and testing. Though there is a close connection between these processes, their conceptions differ. Since all of them are needed for efficient risk management in the area of advancing and operating computer programs, identifying distinctions is of a great importance for the software directors. Their definitions are given below: Quality Assurance: A certain range of operations carried out in order to ascertain in the adequacy of advancing and/or servicing procedure and to ascertain a system is able to attain its objects. Quality Control: A certain range of operations carried out to assess a developed system. Testing: The procedure of running a work product in order to reveal imperfections. (It should be also noted that the “procedure of executing a work product” is about test programming first and only then the process of running the test cases takes place). QA operations ascertain whether the procedure is appropriate and clarified or not. Methods and standards of advancing can serve as samples of QA operations. A QA survey would mainly aim at the procedure components of a program – e.g., are specifications being described properly. In comparison to QA operations, the main purpose of QC operations is to reveal imperfections in certain deliverables- e.g., are the described specifications the true specifications. Testing is one of QC operations. Among others examination can be also mentioned. As a rule, QA and QC operations are needed to succeed in software advancement. There is also a possibility of dispute concerning the responsible person for QA and QC operations -- i.e., whether an outside organization should be responsible for either QA or QC. As the case may be different answers, but the knowledge of Mosaic says the following: When chief manages should be mainly responsible for execution of the right QA, QC and testing operations on a design, an external QA functionality can be useful for important review and prospect. The experience of an institution and its risk management plays a key role in carrying out external QA/QC. While the institutions are developing and getting more experience, managers and other workers will execute appropriate policy. In this case there is no real need in involving external guides.

Application security to persist by gathering the crumbs off the IT budget table in threat-prone and increasingly dynamic apps landscape. Both strategic and tactical investments in measures of application security are a mandatory attribute for organizations which are looking at trenchantly managing risks to their apps, especially applications that are customer facing. With majority of enterprises getting entirely steam ahead on their corporate-oriented and customer-facing mobile applications, the situation is getting even more serious. Insomuch as mobile devices become closer and closer to functionality of PC, security for computer and mobile applications is clamorous. Today great number of organizations, what is concerning application security, goes on to invest in such tactical approaches as adopting scanning and penetration testing tools that figure at the end of the development process while production. Such strategic approaches as code-level analysis and security architecture consulting are not being adopted as they should be. The reasons here are dual, the first are strategic approaches that take time to produce ROI. And the second and apparently the essential is the fact that not great number of programmers are ready to changing their living processes  and incorporating steps as for example security architecture consulting and code-level analysis throughout the software development life process. The first and should be the best way to operate around this is to bring onboard a provider of service which is focused only on testing correctly from the stage of requirements gathering – a test-only vendor that is also take responsibility for preventive security measures as for instance secure design, threat modeling, code-level analysis all over the app life cycle, starting from the requirement phase to manufacture. Moreover enterprises should insist their app suppliers pass with success through the tollgate of a famous 3d party independent validation/verification and certification company. Willy-nilly nowadays’ world enterprises require to produce proactive measures, advanced analytics and after all a more “risk-mitigate” approach to security of application – inside or through proxy 3d party vendors that offer such services. To request a quote for software testing services visit BugHuntress website.

Nowadays most of the testers will attribute their professional experience to the analytical (Analytic) and standard (Standard) test in the classification of schools by Bret Pettichord. These schools stand on strict control of test coverage and compliance with all prescribed procedures when performing tests. The testing process, in this case, includes the following actions: Analysis of the functional requirements Formation of questions and comments (or test requirements) on the functional requirements The study of the updated functional (or test) requirements Development of a manual test script Reading the text of the test script Implementation of actions outlined in the test scenario Analysis of results of completed actions Documenting the results of completed actions Registration of the defect Thus, there is a lot of information transformations before it takes the form, which is the result of the test. In addition, each transformation is made through a brain of the tester. This complicates the testing process for two reasons. First, the conversion of information from text form to the form in which it is stored in the brain and especially back, take a long time. Secondly, the constant reading of the text and generation of other text, based on the previous one is tiring man, significantly reducing his productivity. If you expand the above items in a single chain of transformations, we obtain the following picture: FR -> brain -> TR -> brain -> TS -> brain -> Actions -> Results -> brain -> + defects results' FR - Functional requirements TR - the test requirements TS - test scenarios results' - the results are documented The way to reduce time-consuming during the manual functional testing lies in the brain involvement degree reducing in the transformations represented above until they are completely automated. Currently, there are the following ideas: Automatic registration of defects on the basis of the activities carried out Generation of test cases based on formal functional requirements Generation of test scenarios based on the original functional requirements (e.g., keywords) Using standard tests for the standard types of information systems There is another, more radical option - the exclusion of all intermediate artifacts and reducing of the process to the following: FT -> brain -> Actions -> Results -> brain -> Defects Unfortunately, this is not an option when you ...

All those involved in the mobile Web, must face the problem of testing on different platforms. On the one hand, the testmust be on real devices, on the other hand, many companies can’t enough quickly collect the necessary fleet of devices. Today we’ll write about browser-based emulator for mobile software testing platform called Ripple Emulator.   Installation The main plus of this emulator - easy to install because it is sufficient to GoogleChrome, put this one plug-in and start working. After installation do to enable this plugin, and run your application with the following addition of “? Enableripple = true”. Rewiew Ripple interface consists of a series of panels and the central display, where the application is displayed. These panels contain tools to obtain information about the settings and their changing. And in the central display you can interact with the application. Panel can expand or collapse by clicking on the desired icon, or you can remove the tab that contains the socket. Also panels can be rearranged, depending on your own needs. First start When you first start Ripple either after installation, or for the selected domain the user will be suggested to choose a platform for testing. There are no more options for the first run. Important: When running the demo Ripple it is recommended to choose a platform JIL. Panel of the platform selaction This socket provides a selection of devices that should be emulated. Currently available are the following platforms and devices: Platforms: BlackBerry WebWorks (2.0.0) JIL (1.2.x) Opera (4.0) Web PhoneGap (0.9.1) Vodafone 360 Devices: Generic Resolutions (480 × 320 800 × 480 320 × 240 200 × 240) BlackBerry Bold 9700, BlackBerry Torch 9800, BlackBerry PlayBook HTC G1, Legend, Tattoo Nexus One Sony Ericsson Xperia X10 (All Variants) Samsung H1, M1 Nokia E85, N96, N97/5800 iPhone / iPod Touch (all models) To change the device / platform you have to select new and click “Go!” After selecting the required platform you can start your testing. All the interface of the tool is very logical and easy, so you won’t have any problems with it. To request a quote for software testing services visit BugHuntress website.

All the people occupied in software testing and quality assurance know, that you can’t have perfect skills ever, so you have to learn every day. Some people prefer to visit different conferences in order to get new experience, others like to watch different video courses, but the most popular, even classic way is reading books of course. Here we suggest a top-5 of the best books about testing: Lessons Learned in Software Testing by Cem Kaner, James Bach, and Bret Pettichord This is the best book for the people who want to get some practical knowledge. The authors present about 300 lessons that cover a great variety of questions. All these questions could be interesting to the testing specialist of any level. This book can also be a table one for the whole team of testers,  because there is a huge amount of different practical cases presented there. How We Test Software at Microsoft by Alan Page, Ken Johnston, and Bj Rollison This is another useful book that provide a wide range of insights into Microsoft software testing including in-depth explanations of the practical things. You can be a skilled professional of the beginner, but in both cases you will find something I this book. Perfect Software: And Other Illusions about Testing by Gerald M. Weinberg This is a high-level overview at some testing big questions like “why do we have to test everything?” or “ what makes testing so hard?”. The book is small (about 200 sheets) and that’s why it is quick read. This book is not about practical side of testing, but about it’s “why” side. Perfect for beginners. The Art of Software Testing by Glenford J. Myers This is also the first book to read for the tester. Some questions it describes are already outdated, but it doesn’t make a book bad. It’s hard to find the copy of this book nowadays, but if you do it – you’re lucky. High Performance Web Sites: Essential Knowledge for Front-End Engineers by Steve Souders The book is quick for reading and contains a lot of different useful advices and answers. Some of them are already applied by many companies. In general, this is an interesting book for those who is tasked with web site testing. Have you already read all this? If not, there is some work for you. Don’t miss these really useful books. To request a quote for software testing services visit Testfort website.