Bxp Security and Testing - Revision history

Philip Lacey: /* Session Management Testing = */

2016-05-25T14:10:17Z

‎Session Management Testing =

Thomas Glennon at 10:34, 9 June 2015

2015-06-09T10:34:29Z

Philip Lacey: Philip Lacey moved page Business Express Security and Testing to Bxp Security and Testing

2015-05-04T12:41:06Z

Philip Lacey moved page Business Express Security and Testing to Bxp Security and Testing

Philip Lacey at 08:23, 7 January 2015

2015-01-07T08:23:38Z

Show changes

Philip Lacey at 13:50, 11 November 2014

2014-11-11T13:50:30Z

Philip Lacey at 20:59, 9 November 2014

2014-11-09T20:59:55Z

Philip Lacey at 19:19, 9 November 2014

2014-11-09T19:19:48Z

Philip Lacey at 15:21, 7 August 2014

2014-08-07T15:21:36Z

Philip Lacey: Created page with "== Introduction == Security and security testing is a complex and interconnected area that is constantly changing. As part of the development and operation of Business Ex..."

2014-08-07T15:17:24Z

Created page with "== Introduction == Security and security testing is a complex and interconnected area that is constantly changing. As part of the development and operation of Business Ex..."

New page

== Introduction ==

Security and security testing is a complex and interconnected area that is constantly changing.

As part of the development and operation of bxp software (bxp) our platform is continually tested and reviewed. We group these concepts up to help our clients follow how our rigorous security and development approach is managed.

== Concepts ==

=== Website archetype ===

A website will have a prime archetype:

* Software as a Service solution
* Reference Information Site
* Shop Site
* Game Site
* Interactive Tool facilitating one / all of the previous activities

=== Software Testing ===

In software testing there are a number of types of test and this list is ever increasing:

* Module testing

* Integration testing
** Top-Down Integration testing
** Bottom-Up Integration testing

* Systems testing
** Recovery testing
** Security testing
** Stress testing

* Acceptance testing
** Alpha testing
** Beta testing
** Release testing

== Testing Approaches ==

The archetype will influence the approach and content of the various tests.

bxp is tested under all of the headings above and includes industry compliance and standards checks to constantly improve.

The next challenge about web based solutions is that they are constantly changing. On the web new ways of defeating security are found hourly! So we attempt to be constantly kept up to date by being active members of security communities, data protection circles and other communities.

== Drill down on Security Testing ==

The testing below includes once off and ongoing testing. Security testing of bxp is managed internally in All n One by the Security Department. Client systems security management falls under the remit of the System Champion, nominated by the client at the start of the contract.

* Server/application fingerprint through specially crafted requests;
* Spidering;
* Search engines advanced features (aka Google Dorking);
* Analysis of error messages;
* File extension handling;
* SSL fingerprinting.

=== Business Logic Testing ===

Tests the application logic, in order to ensure that it does not contains vulnerabilities that might be exploited by an attacker to gain an advantage. This includes Web Services & AJAX Testing which are customised to client requirement.

=== Authentication Testing ===

Analyse the authentication process in detail and will check whether it is possible for an attacker to circumvent it. Techniques used included:
* default/guessable passwords;
* Brute forcing;
* Authentication bypass;
* Directory traversal;
* Exploitation of 'remember password' features;
* Reviewing Session Management (login/logout);
* Management of Browser cache.

=== Session Management Testing ===

Assess the robustness of the session management against a broad spectrum of attacks including :

* Analysis of the Session Management Implementation;
* Cookie and Session Token Manipulation;
* Exposed Session Variables;
* Cross-site Request Forgery Attacks;
* HTTP-based attacks (e.g.: HTTP Splitting).

=== Input Validation Testing ===

Checking whether it is possible to inject unexpected and dangerous data on to the site including by:

* Cross-site Scripting;
* Cross-site Tracing;
* SQL Injection;
* LDAP/ORM/XML/SSI/Xpath Injection;
* OS Command Injection;
* Buffer Overflow.

=== Denial of Service ===

* Packet flooding at the application level
* Locking user accounts,
* Filling up disk space,
* Exploiting faulty object allocation.

== Security Audits of bxp software ==

Objectiveness is the single most important part of an audit. If All n One retain a company to audit us, their objectivity can always be questioned, therefore it is our clients who must retain an auditor.

← Older revision		Revision as of 10:34, 9 June 2015
Line 144:		Line 144:
	* Exploiting faulty object allocation.		* Exploiting faulty object allocation.

		+
		+
		+	== Secure File Uploads ==
		+
		+	bxp software offers a service for it's clients to upload their own files and documents to contact history or the e-course module.
		+	In order to provide this as a secure service any file uploaded to bxp will have to pass through an AVG file server edition virus scan.
		+
		+	This has been tested by using a virus test file (eicar - test virus file. http://www.eicar.org/86-0-Intended-use.html)

← Older revision		Revision as of 13:50, 11 November 2014
Line 128:		Line 128:
	Objectiveness is the single most important part of an audit. If All n One retain a company to audit us, the objectivity can always be questioned, therefore it is our clients who must retain an auditor.		Objectiveness is the single most important part of an audit. If All n One retain a company to audit us, the objectivity can always be questioned, therefore it is our clients who must retain an auditor.

		+
		+	All n One's testing is security audit driven as we have found this provides more objective measurable goals.

← Older revision		Revision as of 20:59, 9 November 2014
Line 133:		Line 133:
	[[Category:Topic:About bxp]]		[[Category:Topic:About bxp]]
	[[Category:Topic:Security]]		[[Category:Topic:Security]]
−	~~[[Category:FAQs]]~~

← Older revision		Revision as of 19:19, 9 November 2014
Line 127:		Line 127:

	Objectiveness is the single most important part of an audit. If All n One retain a company to audit us, the objectivity can always be questioned, therefore it is our clients who must retain an auditor.		Objectiveness is the single most important part of an audit. If All n One retain a company to audit us, the objectivity can always be questioned, therefore it is our clients who must retain an auditor.
		+
		+
		+
		+
		+	[[Category:Topic:About bxp]]
		+	[[Category:Topic:Security]]
		+	[[Category:FAQs]]

← Older revision		Revision as of 15:21, 7 August 2014
Line 126:		Line 126:


−	Objectiveness is the single most important part of an audit. If All n One retain a company to audit us, ~~their~~ objectivity can always be questioned, therefore it is our clients who must retain an auditor.	+	Objectiveness is the single most important part of an audit. If All n One retain a company to audit us, the objectivity can always be questioned, therefore it is our clients who must retain an auditor.

@@ Line 109: / Line 109: @@
-== Session Management Testing ===
+==Session Management Testing==
 Assess the robustness of the session management against a broad spectrum of attacks including :
@@ Line 119: / Line 117: @@
 * Cross-site Request Forgery Attacks;
 * HTTP-based attacks (e.g.: HTTP Splitting).
 == Input Validation Testing ==

← Older revision	Revision as of 12:41, 4 May 2015
(No difference)