# Infosys Whitepaper 
Title: Deployment of Public-Key Infrastructure in Wireless Data Networks 
Author: Infosys Technologies 
Format: PDF 1.4 

---

  Page: 1 / 10  

---

   P A Parametric Approach for Security Testing of Internet Applications   Arun K. Singh   E-Commerce Research Lab.    Anand J. Iyer,   Infosys Software Labs. for Test Execution and Research.    Venkat Seshadri  Product Competency Center    Infosys Technologies Limited  Electronic City, Bangalore, India  {arunks, Anandj_iyer, venkatar}@infy.com  Abstract. Security is one of the prime concerns for all the Internet applications. Often it  is noticed that during testing of the application, security doesn’t get due focus and what- ever security testing is done, it is mainly limited to security functionality testing as cap- tured in the requirements document. Any mistake at requirement gathering stage can  leave the application vulnerable to potential attacks. This paper discusses the issues and  challenges in security requirement gathering and explains how it is different from normal  functionality requirement gathering. It presents an approach to handle different factors  that affect application security testing.   1   Introduction  As compared to traditional client-server or mainframe-based applications, Internet applications have  different security requirements [1]. For any Internet application, there is a need to provide an unre- stricted global access to the user community.  This also brings in the threat of outside attack on the  system. The hackers may try to gain unauthorized access to these systems for a variety of reasons and  disturb the normal working of the application.     © QAI India Ltd, 3rd Annual International Software Testing Conference, 2001. No use for profit permitted.<|endoftext|>

---

  Page: 2 / 10  

---

   Presented at the 3rd International Software Testing Conference, India  The security of Internet applications necessarily means prevention of two things: destruction of in- formation and unauthorized availability of information. The broad spectrum of application security  can be expressed as “PA3IN” viz. Privacy, Authentication, (
Authorization, Audit Control,) Integrity  and Non-repudiation.     The first issue in application security is to provide data privacy to the users. This means protecting  information confidentiality from the prying eyes of unauthorized internal users and external hackers.  Before allowing the access permissions to the users, it is essential to ensure the legitimacy. The proc- ess of identifying users is called authentication. Establishing the users’ identity is only half the battle.  The other half is access control/ authorization which means attaching information to various data  objects denoting who can and who cannot access the object and in what manner (read, write, delete,  change access control permissions, and so forth). The third ‘A’ is for audit control which means  maintaining a tamper proof record of all security related events. And then when the data is in transit  across the network, we need to protect it against malicious modification and maintain its integrity.  The non-repudiation means the user should be unable to deny the ownership of the transactions made  by them. It is implemented using Digital Signature [3].   This paper presents an approach for testing security of Internet applications.   2 Issues in Testing Security of Internet Applications  The two main objectives of an application security testing are to:  1.  Verify and validate that the security requirements for the application are met.  2.  Identify the security vulnerabilities of the application under the given environment   For security testing of an application, the first step is to capture requirements related to each of the  security issue. This could not only be a tricky and painstaking exercise because the security require- ments are seldom known very clearly at the time of project initiation. The traditional Use case ap- proaches have proven quite useful in general requirements engineering, both for eliciting require- ments and getting a better overview of the stated requirements [4]. However security requirements  © QAI India Ltd, 3rd Annual International Software Testing Conference, 2001. No use for profit permitted.<|endoftext|>

---

  Page: 3 / 10  

---

   Presented at the  essentially need to concentrate on what should not happen in the system and this cannot be captured  by traditional Use case approach.     Also, the security model of Internet applications has undergone many changes. The traditional model  for securing an application from outside elements mainly relied on access control. This model was  based on creating a hard perimeter wall around the system and providing a single access gate that can  be opened only for authenticated users. This security model has worked well with most of the simple  Internet based applications. The gateway here refers to a firewall that classifies all users as “trusted”  or “untrusted”. In this simplistic model of security, every “trusted” user who is allowed to cross the  gate, gains access to every portion of one’s business and no further security checks are done. As the  requirements for security increases, the applications need to implement a fine-grained security. In- stead of allowing the trusted user to access every portion of the business, the modern security models  divide the business domain into many regions and ensure different levels of security for each region.  This means creating a security perimeter for each region. The first level of security check can not be  very rigorous as one would want to let in prospective customers, vendors and service providers as  quickly as possible. Most of the Internet applications today have multiple security regions with dif- ferent levels of security and these regions could be nested or overlapping with other regions within  same single application. While developing an approach for testing security of these kinds of Internet  applications, a proper strategy planning is very much essential. It is better to plan security testing at  requirement gathering stage itself because there are many issues, which cannot be captured later on  by usual methods of testing [2]. One such example is testing for denial of service attack.    The issues discussed above make security testing of Internet a very challenging task. In the next sec- tion, a parametric approach to security testing is presented and each step is explained with the help of  a sample example.  © QAI India Ltd, 3rd Annual International Software Testing Conference, 2001. No use for profit permitted.<|endoftext|>

---

  Page: 4 / 10  

---

   Presented at the 3rd International Software Testing Conference, India  The Parametric Approach for Security Testing  As discussed in previous section, many of the security parameters cannot be captured and tested us- ing traditional approach. In the proposed parametric approach for security testing, before we start the  requirement gathering, a template to enlist all security parameters are created. This task can be  achieved in four steps as described below:  1.  Create an exhaustive list of all security issues in the application   2.  Identify all possible sub parameter for each of these issues  3.  List all the testing activities for each sub-parameter  4.  Assign weightages corresponding to the level of security and priority.    Once this template is ready, it can be used to streamline each stage of testing lifecycle. The lifecycle  process of security testing is similar to the software development lifecycle process. In the proposed  approach, the security testing lifecycle stages are as follows:  Test bed  Implementation Test Design and  Analysis  Capture  security  test  requirements Test Reporting  Figure 3.1: Security Testing life cycle    a)  Capture security test requirements  b)  Analyze and design security test scenarios  c)  Test bed implementation  d)  Interpreting test reports   In the following sub-section each of these stages are explained.  © QAI India Ltd, 3rd Annual International Software Testing Conference, 2001. No use for profit permitted.<|endoftext|>

---

  Page: 5 / 10  

---

   Presented at the 3rd International Software Testing Conference, India  3.1 Parametric Approach to Capture Security Test Requirements    To define the scope of security testing, check the stated requirement against the parametric template.  This will help in identifying all the missing elements or the gaps in security requirement capture. The  next step would be to allocate appropriate weightages to the various security sub parameters. These  weightages would typically be determined by the nature of business domain that the application ca- ters to and the heuristic data available with the security test experts.     For example, consider an e-shopping application for an online store. The key security requirement for  such an application would be to ensure that the user who provides his own payment information is  indeed, who he claims to be and to make sure that the information provided is correct and is not visi- ble to anyone else. From that perspective, authentication, confidentiality and non-repudiation are the  key parameters for consideration. One possible set of weightages for these parameters could be 0.5,  0.25 and 0.25 respectively (on the scale of 0 to 1). This is in line with the impact; a security breach  could have on the business.    The advantage of assigning appropriate weightages is that it helps to optimize the test scenarios for