Security testing is a process by which the security of a computer system is checked to determine any vulnerability it may have. A number of procedures are often performed for this type of testing, usually to ensure that a system utilizes some form of access control and provides authentic, traceable data when necessary. This usually involves various scans and tests to determine the weaknesses of a system. Security testing is frequently done for networks, especially those with external access such as Internet websites and remote data storage.
Regardless of how security testing is performed, its general purpose is to test a system or network to determine what weaknesses it may have. Various considerations are made for this type of testing, which often form the criteria tested for a system. Access control to a system is one of the most important criteria for security testing and often consists of scans and tests for both authentication and authorization. Authentication is the process by which a system can determine the identity of a user, often through usernames and passwords, while authorization ensures that identified users only gain access to appropriate and approved data.
In addition to access control, security testing frequently checks to ensure that information provided by a system is authentic each and every time it is requested. This information should be protected from unauthorized users, usually through access control, though other methods can be utilized for some systems. It is also important for a system to be available and reliable, which means that networks should be accessible whenever needed. Data transferred between the host system and clients is typically tracked and logged using methods that indicate that transfers are complete, which prevents hosts or clients from later claiming data was not sent.
There are many ways this type of security testing can occur, though it typically involves a number of scans, evaluations, and tests. Initial scans are often used to find potential weaknesses, though these are not actually exploited during these scans. Evaluations can then be performed to determine which weaknesses present a real potential threat and which are merely flaws that might be considered for future improvement. The actual security testing that follows, however, often includes penetration testing in which these weaknesses are used to launch a simulated attack on a system or network. From this testing, information can be gained and prepared as a document to inform the owners or administrators of a system about the weaknesses found and how attacks against them proceeded.