2015 November 13 Archive - EXEIdeas

Do you know the difference between web testing, client server testing, and desktop testing? If you’re like most people, you don’t. Here’s what you need to know and why they are so important.Web Application:Web application testing can be rather complex, and for this reason many people outsource testing to companies like Sec Tec. Web apps are a bit different from other types of applications, and the tester typically doesn’t have much control over it.The application is loaded on the server, where its exact location may not be known and there’s not executable file to attack.Testers often have to test it on different web browsers. Applications are supposed to be tested this way, as well as on different OS platforms. In this sense, testing is more about compatibility than security.But, for a true security professional, security must also be tested. Often, security testing involves more than just a scan. Penetration testing is used to check the vulnerability of the application and how easy it is to exploit.For pen testers, the goal is to “break” the application (though not by permanently crippling the company or organization’s software) by finding weak points where a legitimate attacker might succeed in destroying the company’s app or gain entry to do other kinds of damage, including unauthorized data access and migration.Testers routinely test for faults in applications as well as non-technical vulnerabilities, like social engineering.Social engineering refers to the practice of compromising a company’s security by using psychology, rather than technology, to defeat established security protocols.Testers may, for example, try to gain access to data centers, proprietary company files, or to employee data by posing as an IT professional, new manager, or staff member that has authority to access privileged or otherwise secure data.Testers may employ tactics like asking for employee usernames and passwords, “piggybacking” into secure areas with authorized staff by pretending to need access to an area without having a keycard or security credentials. A tester may follow an employee in through a secure entryway, for example, without a keycard, asking the employee to hold the door for him or her.These low-tech methods bypass technology by getting direct access to servers and computers, usernames and passwords.Web app testing is crucially important today because of the prevalence of web-based payment systems.Client Server Application:In a client server environment, there are two different components to the test. First, an application is loaded on a server while the executable file is on every client machine. Tests are done on GUI, on both sides, as well as tests for functionality, load, client-server interaction, backend, and vulnerability testing (penetration testing).Desktop Application:This is an app that runs on your personal and work computer. When you run a test on your desktop application, you’re really focusing on a specific environment. While many (most) applications are connected to the web today, they don’t have to be.And, a true desktop application isn’t connected – it’s isolated on the computer. It’s limiting in that sense, but troubleshooting and testing the application is also orders of magnitude easier as long as the computer isn’t connected to the web.Even when desktop applications are connected, testing is usually limited to the desktop and securing it from outside and internal attacks. Generally, a tester will test the application’s GUI, functionality, load, and backend.About the Author:David Wray is a certified TigerScheme SST, with twenty years experience in technical Internet security. Beginning his career with the Peapod Group as a Firewall Engineer, David went on to found Sec-Tec Ltd in 2000, which specialises in penetration testing and technical assessment services. David is a guest expert on LBC radio, and can often be heard providing insight into information security news and current affairs.Find Me On LinkedIn