Security testing is an essential part of software development. As applications become increasingly networked and deal with high volumes of sensitive information, finding security vulnerabilities early is important.
Whatever software you're developing, whether it's a traditional web application, enterprise application or Web3 application, there are many risks relating to user information, financial transactions and downtime.
The best way to approach this is to have security testing as a core part of your SDLC. This means that you can find and evaluate risks at each step of the development process.
What Is Security Testing?
Security testing is the process of identifying vulnerabilities, issues and misconfigurations that could be exploited within a software application.
While functional testing will verify your application works as expected, security testing looks to see if users can access information they shouldn't, change how the application behaves or exploit any vulnerabilities.
For example, your application may pass functional testing, however when running security testing you may find a customer can change the account ID of another customer and view their transaction history.
Security testing should be considered as a continuous engineering practice.
Six Key Types of Security Testing
There are various types of security tests that can be run to identify different types of vulnerabilities. Using a combination of different tests will give you far better coverage.
1. Static Application Security Testing (SAST)
Static Application Security Testing is testing source code.
This helps developers understand any potentially risky code.
Common security issues identified include:
- Hardcoded passwords/API keys
- SQL Injection
- Unsafe data handling
- Weak cryptography
- Poor input validation
This is useful to run during development and code reviews.
2. Dynamic Application Security Testing (DAST)
Dynamic Application Security Testing is testing while the application is running.
As opposed to SAST, this interacts with the application from an external perspective.
This can identify issues such as:
- Cross site scripting (XSS)
- SQL Injection
- Incorrect security headers
- Poor session management
- Exposed endpoints
This is commonly run in testing/staging environments to understand how the application would respond to potentially malicious requests.
3. Software Composition Analysis (SCA)
Modern applications will often use third party libraries, frameworks and packages. If they have known vulnerabilities then this can cause issues.
This will help identify any vulnerable or out-of-date components within your application.
This will help your development team identify vulnerabilities in open source packages, track third party components, identify any out-of-date components and identify licensing and dependency issues.
Dependency scanning should be regularly performed, especially on applications using lots of external libraries.
4. Vulnerability Scanning
Vulnerability scanning looks across your application, server, network and infrastructure to identify known security vulnerabilities.
This can identify out-of-date software, exposed services, insecure configurations and missing security updates.
This should be done regularly. Especially after any changes to your infrastructure or large changes to your application.
However it doesn't guarantee that all identified vulnerabilities can be exploited. It should be reviewed and prioritised based on the actual risk.
5. Penetration Testing
Penetration testing is the process of authorised security experts trying to exploit vulnerabilities in your application or infrastructure.
This is a manual process that will look for complex security issues and combinations of vulnerabilities.
This can identify:
- Bypass authentication
- Broken access control
- Business logic flaw
- Privilege escalation
- API security issues
On Web3 applications, specialist testing can also be performed to identify issues with smart contracts, transaction validation and authorisation.
Penetration testing is very useful to run before large releases, especially when large changes have been made.
6. Threat Modelling & Secure Code Review
Threat modelling looks to identify any potential security threats during design.
This will help your development team understand how data is coming into your application, who can access certain resources and what could happen if your security fails.
Secure code reviews allow developers and security experts to look at choices made when implementing features that may not be picked up by automated tools.
This will help identify any architectural or logical issues.
When Should Security Testing Be Performed?
Security testing should be implemented throughout your development process.
Requirements & Design
Identify any sensitive information, authentication, access and potential attack scenarios.
Threat modelling helps developers understand possible risks.
Development
Use SAST tools, secret scanning and secure coding practices. Security should also be considered in code reviews.
This will help you find vulnerabilities in development so they can be fixed.
Testing
Run DAST, dependency testing, vulnerability scanning and security regression.
This will help verify your security measures are working as expected.
Pre-Release
Run penetration testing and final security checks to identify vulnerabilities that may have been missed.
Any critical issues should be fixed and retested.
Post Deployment
Continue to monitor your application, manage vulnerabilities, apply patches and run regular security reviews.
Just because your application passes a security test doesn't mean it will stay secure as the code, dependencies and infrastructure will change over time.
Why Security Testing is Important for Web3 Applications
Security testing becomes an important aspect when working with Web3 applications as they may interact with blockchain networks, decentralised protocols, wallets and smart contracts.
If there is an issue with smart contracts then this can often be hard or impossible to undo once transactions have been processed.
Web3 development teams should focus on the following:
- Smart Contract Vulnerabilities
- Incorrect access control
- Reentrancy & Transaction manipulation
- Wallet authentication & private key protection
- API & Backend Security
- Incorrect transaction validation
- Integration issues with external protocols
Traditional security testing should be applied to your frontend, backend, APIs and infrastructure. You should also use specialist testing to audit smart contracts.
By combining both you'll create more resilient applications.
Common Security Testing Mistakes
Even organisations using security testing tools may miss a lot of security issues.
Some common mistakes are:
Only performing testing near the end of deployment. This means vulnerabilities aren't found during development.
Only using automated tools. While they will identify known patterns they may not identify any business logic flaws.
Not acting on security reports. This won't provide much benefit as no-one is taking responsibility for finding and fixing.
Ignoring third party dependencies. Having out of date libraries and vulnerable packages can cause issues.
Not doing regression testing. Every vulnerability should be tested to make sure it doesn't appear again in the future.
Best Practice for a Secure SDLC
To improve your software development process follow these simple principles:
- Implement threat modelling during design
- Use SAST & secret scanning during development
- Regularly do dependency checks
- Use DAST to test running applications
- Schedule penetration testing for important deployments
- Prioritise vulnerabilities
- Assign responsibilities
- Perform security regression testing
- Continuously monitor applications
The aim isn't to add extra tools but to have a repeatable process to find, assess, fix and verify vulnerabilities.
Final Thoughts
Security testing is an essential part of providing reliable software. Each type of testing looks for different types of risk and no one type will find all vulnerabilities.
By implementing threat modelling, static testing, dynamic testing, dependency scanning and penetration testing throughout your SDLC you can help improve your application security and reduce the chances of preventable issues appearing in production.
If you'd like a deeper understanding of different security testing types and who is responsible for what, take a look at this guide on security testing in the software development lifecycle.
Creating secure software requires constant focus, teamwork and testing.
Top comments (0)