The ABC of System Security

30 January 2018

In simple words security testing stands for detecting system’s potential vulnerabilities by simulating attack, aimed at accessing sensitive data. Years ago people would rely on ready-made security tools (antivirus, system scan) to ensure data protection.

Nowadays this approach no longer works due to fast-growing progress in both: development and hacking industries. Tools, used before can not keep up with this evolution for two major reasons — 1. Hacking methods grow more and more sophisticated, 2. Substantial amount of businesses become digital, this resulted in great variety of software solutions and automatically made it impossible to utilize ready-made security tools.

ABC of Security Testing

Just think of how many potential hacking points of entry there are: public tools, area-specific systems, smart home appliances, toys, apps and websites. It is impossible to imagine modern life without using one/several hack-inclined items. Furthermore the risk of data breach applies to systems of any scale. As we learn from the news even such formidable structures  as nuclear programs, banking systems, social networks are not immune to being hacked. Needless to explain why massive systems do not rush to acknowledge vulnerabilities or warn users of potentials dangers for that matter. In best cases system threats are tackled with minimal users’ awareness. Sometimes however public disclosure of a hack is inevitable — this comes along with significant losses.

While no business wants to jeopardize own reputation, the type of business itself determines potential damage scale in case of a breach. Hence here is the list of system types to consider security testing in order from the top critical to less critical damage risks:

  • National security, governing systems
  • Legacy systems
  • Industry specific systems (aerospace, hospital, bank software)
  • Systems, utilizing private fiscal data (credit card, payments history)
  • Systems, utilizing personal data: geolocation, contact information, personal attributes (photos, videos, etc)

It is highly recommended to implement custom made  security testing in the above-listed system types. There are two pivotal aspects of security testing:

  • Custom approach will ensure that technical and business specs of a system are considered by test plan creation, thus will result in maximal efficiency
  • In order to maintain desired level of protection security testing should be done on regular basis. Depending on system — from time to time  check will come in handy to troubleshoot and prevent losses.

Now it may seem somewhat excessive to commit to security checks on regular basis. Consider this a small investment in big problem prevention. After all, lost trust and undermined reputation have greater value than security checks. In addition occurred issue will require undetermined time to detect its origin and location — this may be critical for live production.

Who should conduct security testing? Project team, previously involved in development is the ideal choice. Mostly because people have deep knowledge of the system, its components and their interactions. This will ensure minimal time, spent on issue search & fix. If project team is not available, project documentation is highly recommended to provide general system information.

To sum up — software development progresses at amazing pace. The same applies for ransomware and the rest of data breach methods. Keeping your software up to date ensures quality operation while regular security checks serve as guarantee for system and customer’s data protection. System security is natural extension of the software itself and works best when custom made for specific product.

Written by Irina Ukrainets, NIX Solutions Business Development & Project Manager