Web application security: Getting QA involved

Quality assurance (QA) departments have traditionally focused on functional testing -- making sure that an application works properly and performs tasks seamlessly. But it is increasingly important for the QA department to be involved in application security testing, a process that includes complex checks, such as testing for SQL injection and cross-site scripting.

Choosing the right tool for Web application security testing

The QA department will need application security testing software that is able to perform tests as a non-authenticated user, an authenticated user, and an administrative user to determine the vulnerabilities inherent in each user class. Additionally, the Web application security tool should be able to perform both automated and manual crawling/spidering of your Web application.

Automated application security testing software will spider the entire application by clicking every button and link, filling out data fields to identify the structure of the program, and then auditing each page for vulnerabilities. It should do this from the outside in, reviewing each portion of the site the way an external hacker might, ideally from behind the scenes. This comprehensive approach ensures that all security holes have been identified and can be fixed. On the down side, it can also produce false positives, and it may not be able to access all of your Web pages due to the way that certain pages are coded.

Manual testing allows a user to focus on specific pathways or tasks on a Web site while the software tracks the process. The program can then audit the particular path that the user has taken for security vulnerabilities and provide a report. Manually crawling an application can be time consuming, but it also ensures that specific pages are tracked and analyzed.

Basic guidelines for choosing an application security testing product

The following basic questions should be addressed when you are looking for a Web application security testing product:

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine