Security Testing

What is Security Testing?

Most companies have experienced the unfortunate consequences of computer security breaches. The risks come from a host of sources ranging from disgruntled employees to malicious outsiders with no apparent motive. Security testing eliminates the loopholes that unauthorised parties use to gain access to software systems.

The Need for Security Testing

Most businesses are aware of the significant financial loss that occurs when an unauthorised party has gained access to the company’s finances.

Some of the worst financial losses result from industrial espionage, legal proceedings as a result of privacy violations, and loss of revenues when hackers overload a system with junk data. It is estimated that about 90% of companies have sustained a security-related financial loss, with 74% of these suffering significantly.

However, these are often the least damaging losses that a company suffers as a result of a security breach. Often the most serious damage that occurs as a result of breached security is the loss of customer confidence. The resultant loss of market credibility can undermine the company’s best marketing initiatives.

Security Testing - Services Offered

Test and Data Services (Pty) Ltd offers a consulting service that will evaluate and improve the client’s system security in five important ways:

• Systems Hardening. The two most important aspects of system hardening are that:
  • It ensures that only the appropriate system elements are installed.
    Almost all operating systems include unnecessary services in their default installation. This makes the initial installation easier; however, these unnecessary services increase the system’s vulnerability to attack.
  • It ensures that all up-to-date patches are loaded.
    New vulnerabilities in a system are constantly being discovered as the hacker community researches and exploits new weaknesses in a system’s security. The vendors usually release small software updates to patch these flaws - typically within about 60 days of the vulnerability becoming known. System hardening ensures that all the necessary patches are loaded.
• Application Security
  Application security follows the business logic of an application to ensure that it is secure within a company’s business framework. For example, a system might not allow large monetary transfers without authorisation by at least two senior people.
• Framework Design and Implementation
  This technique addresses all the security procedures and standards within an organisation, such as:
  • Limitations on physical access to strategic computer equipment.
  • Standard installation rules for a new server.
  • Signing of non-disclosure and secrecy documents.
  • The company’s policy on downloading e-mail attachments.
• Framework Design Audit Testing
  After the security framework has been designed and implemented, it needs to be tested to determine how well it has been implemented. An example of this would be to test if the security guard allows an unauthorised person to gain access to strategic computer equipment.
• Vulnerability Audit
  This audit simulates the behaviour of a hacker, and determines what level of skills and effort would be required to compromise the system.

Security Testing - Service Delivery

Security testing services can be supplied in the following ways:

• Consulting
  Clients often experience difficulties that require the input of an experienced security testing consultant. Test and Data Services’ consultants are able to offer advice and guidance on an ad hoc basis.
• Resources
  Security testing resources are offered through Test and Data Services’ Software Testing Bureau located at Test and Data Services’ premises. This convenient service enables clients to have software tested away from their premises. This frees the client from the burden of managing contracting staff and providing other facilities such as workstations.

Contact