Testing And Monitoring of Networks for Security

eBay, iTunes, PayPal -- these are just a few of the places that most of us enter our credit card and personal information every day. Since the Internet became an integral part of each of our lives, the treat of identity theft is a daily reality for all but the most paranoid of Internet users.

While we assume that the sites listed above are secure, how many of us have in fact checked to see to what lengths these companies go to keep their user's information safe from hackers? I'm sure very few.

Because we can't count on our registrants to be careful when entering information onto the registration website, as event planners, we must make sure that we do the research to ensure that our registrant's information is safe with our online registration company. We want to send potential registrants to a site that portrays our event in a positive light. This means a website designed to our specifications, with professional quality and ease of use. But, most importantly, it means knowing that all information put online for our event will be safe from identity thieves.

One of the most important aspects of a strong security system is frequent testing and monitoring of those systems. To receive the highest rank of Level 1 PCI compliance from Visa, companies must invest a large number of resources to ensure that they are as secure as major banks and credit card companies. As of yet, very few registration companies hold this ranking, but wouldn't it be nice to know that your registration company values your registrants' security enough to make it one of their highest priorities?

Constant monitoring and testing of security is a vital part of maintain the highest possible level of security. Some methods of monitoring include an independent daily audit for over 3,000 security checks, (exceeding the highest government standards including the FBI "Top twenty security vulnerabilities" test) and separate hourly, daily, weekly, and monthly backups that are archived for at least two years.

Other important factors to look for are the TRUSTe and Thawte logos. These companies monitor the strength and maintenance of privacy policies and information encryption. According to the website, to be certified by TRUSTe, companies must have their privacy policy open for review by TRUSTe, post notice and disclosure of collection and use practices of personally identifiable information, and give users choice and consent over how their information is used and shared.

While TRUSTe ensures that companies hold to their privacy policies and never use information without the user's consent, Thawte verifies SSL (Secure Socket Layer) encryption, meaning that the encryption of credit card information entered on the site if of the highest level possible. However, to be verified by Thawte, companies must meet stringent checklist of qualifications including both authentication and verification processes. For the authentication process, Thawte must confirm that the company registration details are entirely true and that the domain is in fact owned by the requesting party. To complete the verification process, Thawte uses a third party telephone listing to confirm that the authorized person requesting a certificate is employed by requesting party.

These are just a couple of the certifications to look for when choosing your online event registration system. When you send your attendees to the registration site, you want to be 100% sure that their data will be 100% safe so they won't have to research the security, but if they do, you can be confident that they'll like what they find.

About the Author:

Ryan is a member of the marketing team for RegOnline, a producer of easy-to-use online registration software, and a company dedicated to making event planners' lives easier.

For more information on Software Testing, visit Software Testing Concepts.

Basics of Web Security Testing

Exposing systems to the internet increases the risk that
security weaknesses in those systems will be leveraged
to compromise the system or the underlying data. It is
therefore necessary to examine the actual business risks
this brings, understand the basic difficulties in implementing
"secure systems", and adequately test internet applications
for security, as well as functionality and load performance,
before they are exposed to the net.

Introduction

Most organizations now have some of their corporate IT
infrastructure connected to the internet. This may vary
from allowing users to surf the web and receive email,
to fully functional internet banking systems. For some
organizations, compromise or failure of these systems
would have significant business impact.

Software testing is becoming an accepted part of the
development and maintenance cycle. Internet solutions
are often required to be implemented extremely quickly.
Functional, usability and load testing are all as appropriate
for internet as conventional client-server solutions, however
the requirement to test security is more emphatic for
the internet, due to the much wider connectivity -- to the
incompetent, nosy or malicious -- the Internet brings.

The Risks

Why should an organization care about compromise of their systems?

Direct Financial Loss

If a payments system is being operated, the contracts with
the banks and the credit card organizations will specify
significant financial penalties and charges that will be
levied in cases of continuing fraud. In addition, the cost
of shipped goods for which payment will not be recovered
needs to be taken into account.

Loss of Reputation

Many hackers do it for the public recognition and therefore
will publicize the compromise of a site. Security news
sites are also very quick to learn of compromises. The
UK consumer is still nervous about transmitting payments
information across the web -- gaining a reputation as an
insecure site will affect Internet business growth.

Legal Repercussions

The Data Protection Act places a legal responsibility on
organizations to keep person-identifiable data secure. The
Data Protection Registrar may take legal action against
organizations that breach this obligation, in addition to civil
damages suits from affected individuals. Also, exposure
of commercially sensitive data acquired under contract or
privilege may lead to damages suits from affected parties.

Testing as Part of a Solution

Security testing of internet solutions provides two
fundamental services:

It allows cost-effective selection of security controls at all
stages of the project cycle, allowing proper integration
of security measures (procedural and technical) into the
final solution;

Management are given firm evidence of the level
of security provided, showing that, in the event of a
security breach, "due diligence" was exercised, which
may limit damages claims or criminal liability.

Testing a system will involve a number of separate
checks:

• All software involved should be examined for known security flaws;
• The infrastructure design should be implemented to allow secure operation;
• Site functionality should be examined to ensure that access to sensitive information and administrative functions is protected appropriately. This applies to operating system and server level functions, as well as application level;
• Only services necessary for the business process should be running on web-facing servers (the more different systems, the greater the likelihood of a serious flaw);
  
• Network traffic should be monitored to check for plain text transmission of user names and passwords (whether related to site users or to back-office functions such as databases).

If flaws are found, detailed analysis should follow, which will
attempt to identify software patches, replacement service
daemons or applications, or additional technical issues.

Summary

Since web-facing systems provide numerous opportunities
for unauthorized access to areas of a computer network,
security testing is a critical activity. This paper highlights
the need to "design in" and "test out" security from the
beginning of a project lifecycle.

Taking this approach, costs are reduced by:

• Undertaking the work as an integral part of the design, development and testing, thereby reducing the need for additional staff to undertake separate sub-projects;
• Reducing rework on security design so often highlighted by extensive penetration testing at the later stages of a project.

AppLabs has considerable experience of security testing in
web-facing systems and can increase the success of your
project through early involvement in the planning process,
and a rigorous implementation of these methods.

Source: AppLabs.com

For more information on Software Testing visit http://www.qa-software-testing.com