Application Security

Application Security testing focuses on identifying application and configuration vulnerabilities that could lead to security issues. The goal of the reviews is to identify as many potential security vulnerabilities as possible. Application Security Testing can be performed using both or anyone of the below mentioned approaches/methods:

·         Tool Based Scan/Vulnerability Scan:  In the tool based scan or vulnerability scan a tool is used to perform the security checks on the application.

·         Manual Security Scan/Penetration testing : The penetration testing or manual security scan is a method where the application is exploited manually with the use of proxy tools. Findings flaws in the design and business logic.

Further, there are two ways to perform the Application Security Testing: - Static and Dynamic. Depending on the stage of the application in SDLC cycle, any one way can be used.

·         Static Analysis: Static Analysis also termed as Static application security testing (SAST) can be thought of as testing the application from the inside out – by examining its source code, byte code or application binaries for conditions indicative of a security vulnerability.

·         Dynamic Analysis: Dynamic Analysis also termed as Dynamic application security testing (DAST) can be thought of as testing the application from the outside in – by examining the application in its running state and trying to poke it and prod it in unexpected ways in order to discover security vulnerabilities

Best testing tools in the market

Open Source Tools
​Test Management Tools	​Functional Testing Tools	​Load Testing Tools
Bugzilla Testopia  FitNesse  qaManager  RTH (open source)  Salome-tmf  Squash TM  Test Environment Toolkit  TestLink  Testitool  XQual Studio  Radi-testdir  Data Generator	Selenium  Soapui  Watir (Web Application Testing in Ruby)  WatiN (Web Application Testing in .Net)  Capedit  Canoo WebTest  Solex  Imprimatur  SAMIE  ITP  WET  WebInject	FunkLoad  JMeter  FWPTT load testing  loadUI
Commercial Tools
​​Test Management Tools	​​Functional Testing Tools	​​Load Testing Tools
HP Quality Center/ALM  QA Complete  T-Plan Professional SMARTS  QAS.Test Case Studio  PractiTest  SpiraTest  TestLog ApTest Manager  Zephyr	QuickTest Pro  Rational Robot  Sahi  SoapTest  Test Complete  QA Wizard  Squish  vTest  Internet Macros	HP LoadRunner LoadStorm NeoLoad WebLOAD Professional Forecast ANTS – Advanced .NET Testing System Webserver Stress Tool Load Impact

Test Tool evaluation criteria - a mind map

A mind map for companies and users to select test tools for evaluation.

Tool Evaluation - Mind Map

Business value articulation of Automation

Showing key stakeholders that your test automation efforts are worth continued investment is often tricky, because value is a relative term that varies based on a given organization's needs. One important aspect in relaying value is telling a well-rounded story of how test automation has been beneficial to your organization. This story might include the following:

 

·         Script Development Metrics - Identifying metrics related to the percentage of manual tests that have been automated helps to reveal the productivity of your team

·         Cost Savings ROI - The amount of money that has been saved in the test implementation

·         Efficiency ROI - The amount of time that has been saved in the test implementation

·         Risk Reduction ROI - The amount of money that has potentially been saved by reducing risks, increasing test coverage, and allowing manual testers to focus on finding costly, hard to find defects

·         Defects Identified - The number of defects found during automated test development and/or implementation

·         Organizational Impact - Revealing how the introduction of automation has caused testing to be done earlier, or how it has caused development and/or testing practices to improve, or how some small utilities you've created are being used by other teams to increase their efficiencies

The Business value articulation of this problem is the most sought after deliverable.