What are security incidents and how do I choose best approach

There are lots of talks these days but very few people really know exactly what does it mean. In this article we will do our best in order to explain terminology so you can create best choice which will fit your needs.

SECURITY TESTING is a type of Software Testing that uncovers vulnerabilities, threats, risks in a software application and prevents malicious attacks from intruders. The purpose of Security Tests is to identify all possible loopholes and weaknesses of the software system which might result in a loss of information, revenue, repute at the hands of the employees or outsiders of the Organization.

The main goal of Security Testing is to identify the threats in the system and measure its potential vulnerabilities, so the threats can be encountered and the system does not stop functioning or cannot be exploited. It also helps in detecting all possible security risks in the system and helps developers to fix the problems through coding. Apart of the system security testing we are providing services related to the complete IT ecosystem testing including your physical perimeter protection or even your staff testing and their resilience to internal or external threats.

There are seven main types of security testing as per Open Source Security Testing methodology manual. They are explained as follows:

• Vulnerability Scanning: This is done through automated software to scan a system against known vulnerability signatures.
• Security Scanning: It involves identifying network and system weaknesses, and later provides solutions for reducing these risks. This scanning can be performed for both Manual and Automated scanning.
• Penetration testing: This kind of testing simulates an attack from a malicious hacker. This testing involves analysis of a particular system to check for potential vulnerabilities to an external hacking attempt.
• Risk Assessment: This testing involves analysis of security risks observed in the organization. Risks are classified as Low, Medium and High. This testing recommends controls and measures to reduce the risk.
• Security Auditing: This is an internal inspection of Applications and Operating systems for security flaws. An audit can also be done via line by line inspection of code
• Ethical hacking: It’s hacking an Organization Software systems. Unlike malicious hackers, who steal for their own gains, the intent is to expose security flaws in the system.
• Posture Assessment: This combines Security scanning, Ethical Hacking and Risk Assessments to show an overall security posture of an organization.

 General recommendation is to proceed with security testing prior implementation of any changes on your infrastructure, if we are talking about the computing environment or to provide adequate testing in case of the preparation for Disaster recovery of Business continuity process where we as experts can assist….

In our testing we are utilizing SDLC lifecycle which contains of 7 sub-phases which are customized in accordance with your needs. Even of you do not choose us as partner we will be glad to assist you in creation of your request for some other vendor. SDLC phases are:

• Defining requirements. Security analysis for requirements and check abuse/misuse cases
• Creating security scan design. Security risks analysis for designing. Development of Test Plan including security tests
• Performing Coding and Unit Testing. Static and Dynamic Testing and Security White Box Testing
• Integration testing. Performing black box testing
• Performing system testing. Providing black box testing with vulnerability testing
• Implementation testing. Providing penetration testing with vulnerability scanning
• Supporting activities. Performing Business impact analysis and patch management evaluation

Is it clear now??? Do you need more assistance? Please be free to contact us and we will be more than glad to respond on your inquiry. You can contact us on predrag@skundric.com or via our contact page where you can submit all your questions www.skundric.com/contact