[Day 7] 3. Security Testing

Why Is Security Testing Required?

• Business Impact:
  • Avoid downtime and disruptions.
  • Ensure business continuity.
• Reputation Protection:
  • Prevent reputation loss due to security breaches.
• Financial Safety:
  • Mitigate financial losses and safeguard revenue generation.

---

Core Testing Principles:

• CIA Triad:
  • Confidentiality: Prevent unauthorized access to sensitive information.
  • Integrity: Ensure data remains unaltered and accurate.
  • Availability: Guarantee systems and data are accessible when needed.

---

What is Security Testing?

A systematic examination of an organization's network, policies, and security controls to identify and address potential risks.

---

Types of Security Testing:

1. Audit

• Purpose: Verify compliance with policies, standards, and regulations.
• Key Features:
  • Checklist-based, generally non-technical.
  • Examples:
    • ISO 27001 compliance: Employee background verification.
    • Antivirus installation requirements.
  • Auditors may request logs and evidence for validation.
• Misconception: Audit is not about identifying vulnerabilities but ensuring compliance with predefined standards.

---

2. Vulnerability Assessment (VA)

• Purpose: Identify weaknesses/vulnerabilities in the system.
• Key Features:
  • Diagnoses problems and uncovers vulnerabilities.
  • Focus areas: Web/mobile applications, networks, operating systems.
  • Main Objective: Identify security weaknesses.
  • Example: Finding outdated software or exposed APIs.

---

3. Penetration Testing (PT)

• Purpose: Exploit identified vulnerabilities to demonstrate risks.
• Key Features:
  • Conduct simulated attacks in a controlled environment.
  • Proves the seriousness of vulnerabilities to stakeholders.
  • Helps organizations prioritize patching to mitigate risks.
  • Without identifying vulnerabilities, PT cannot be performed.
• Potential Risks of Ignoring Vulnerabilities:
  • Revenue loss.
  • Reputation damage.
  • Government fines and penalties.
  • Legal challenges.
  • Customer dissatisfaction.

---

Key Components of Security Testing:

• People, Process, and Technology: All three play a crucial role in securing systems.

---

Example Scenario:

• Scenario: Sunbeam wants to identify weaknesses in their security system.
• Action Plan:
  • Engage vendors offering security testing services.
  • Vendors provide a questionnaire to gather details about the organization's infrastructure and applications.

---

Scoping Questionnaire:

• Purpose: To gather information for security testing.
• Sample Questions:
  1. How many servers are deployed?
  2. What are the key modules and functionalities of the system?
  3. What levels of users interact with the system?
  4. What technologies are used?

---