SaFi Bank Space : Security Testing

 Overview

Application security test aims to verify the security controls if working as expected and proactively checking for new threats, vulnerabilities, and gaps to ensure desired level of security is maintained.

Test Methodology

Security tests should be performed in different levels of software development. Each level have different set of test tool and strategy but focuses a particular area of interest. All activities to perform test cases should align with Security Testing Guideline.

Scope

All new features or change requires a security test as minimum requirement but can be changed upon assessment of business requirement.

Test Cases

The security testing will have:

1. Unauthenticated Security Testing. This case is non intrusive and tests the current security posture with all the controls in-place to verify everything is working as it should and ensuring desired level of security is achieved. Conducted quarterly

2. Authenticated Security Testing. This case is non intrusive and tests the actual target without other controls protecting it. This aims to check and verify how resilient the current target to security attacks without any controls. This includes the code review (SAST) to application source code.

3. Penetration Testing. This case is intrusive and aims to penetrate the target with all the controls in placed. This check and verify how resilient the current target to security attacks including its controls.

4. Robustness Testing. This case is intrusive and aims to disrupt the operations of the target with all the controls in placed. This verify how robust the application to abuse like denial-of-service (DoS) attacks.

5. Compliance Posture Testing. This case is non-intrusive and aims to check the existing configurations in the infrastructure if compliant with existing standards like PCI-DSS, NIST, HIPAA, and etc.

6. Infrastructure Testing. This case is non-intrusive and aims to check the vulnerabilities available in the network infrastructure.

AST-1: Unauthenticated Security Testing

Pre-condition

1. Target environment is ready and built for security testing

2. All security and network controls is working.

Expected Result

Scan result and list of assessed vulnerabilities.

AST-2: Authenticated Security Testing

Pre-condition

1. Target environment is ready and built for security testing

2. All security and network controls is bypassed or whitelisted.

3. Test user accounts created per role.

Expected Result

Scan result and list of assessed vulnerabilities.

AST-3: Penetration Testing

Pre-condition

1. Target environment is ready and built for security testing

2. All security and network controls is working.

3. Test user accounts created per role.

Expected Result

Scan result and list of penetrated vulnerabilities.

AST-4: Robustness Testing

Pre-condition

1. Target environment is ready and built for security testing

2. All security and network controls is working.

3. Test user accounts created per role.

Expected Result

Scan result and list of DoS vulnerabilities.

AST-5: Compliance Posture Testing

Pre-condition

1. Target environment is ready and built for security testing

2. All security and network controls is working.

Expected Result

Scan result and list of compliance gaps.

AST-6: Infrastructure Testing

Pre-condition

1. Target environment is ready and built for security testing

2. All security and network controls is working.

Expected Result

Scan result and list of assessed vulnerabilities.