A Security Testing Process Supported by an Ontology Environment: A Conceptual Proposal

This study aims to analyze and improve the security of the SawitGoDigi Palm Oil Harvest Recording Information System using grey-box and white-box testing approaches. The system is used by farmers, agents, drivers, and administrators to manage land data, harvest results, distribution, and transaction records, which makes it highly exposed to security risks if vulnerabilities are present. The security testing process was conducted based on the OWASP Web Security Testing Guide (WSTG) v4.2 and the OWASP Risk Rating Methodology. The testing stages included reconnaissance, automated scanning using OWASP ZAP, manual exploitation, risk evaluation, implementation of security improvements, and retesting. The results revealed several significant vulnerabilities, including SQL Injection in the search feature, weak session management through the trusted_device cookie, and the absence of a rate-limiting mechanism that enabled brute-force attacks during the login process. The risk assessment indicated that SQL Injection and session hijacking were classified as High risk, while brute-force attacks were categorized as Medium risk. Security improvements were implemented through the use of prepared statements, strengthening cookie attributes, adding security headers, and implementing rate limiting. Retesting results confirmed that all identified vulnerabilities were successfully mitigated and reduced to a Low-risk level. This study demonstrates that a comprehensive security testing approach, which includes exploitation, remediation, and verification through retesting, can significantly enhance the security of agribusiness web applications. Furthermore, the findings show that before remediation, the system contained four vulnerabilities with High and Medium risk levels, namely SQL Injection, Session Hijacking, Brute-Force Login, and Security Misconfiguration. After the remediation and retesting process, all High- and Medium-risk vulnerabilities were successfully reduced to Low risk or marked as Closed, indicating that the system is secure for operational use.

Early identification of defects and prevention of defects migration are key goals of the software security testing process. Early integration of security testing activities into the development lifecycle leads to secure software development. The prescribed key activities of security testing are closely interconnected with security development life cycle to deliver secure software. Software test process elaborates various testing activities and describes which activity is to be carried out when. Given the need and significance of phased approach of security testing, this paper proposes different testing activities to be carried out while integrating it within the security development life cycle.

In this paper, we present the results of case studies conducted in three software companies in order to identify the improvement targets in their test processes. The test processes were modeled using the LAPPI (A Light-weight Technique to Practical Process Modeling and Improvement Target Identification) technique. Identifying improvement targets quickly and in a cost-effective way is important to maximize the value of SPI (Software Process Improvement) initiatives. The most significant problems identified in this study were the low level of unit testing, unknown repercussions of code changes, and missing exit criteria for testing. These findings support the results of earlier studies. Further, a less reported problem was identified. It appears that software companies find it difficult to integrate test automation with their manual test processes. Making the recurring test related problems known among the software industry helps to justify the need for test process improvement and standardization of test processes.

Since the birth of the Internet, the quality of network service has been a widespread concerned problem. With the continuous development of communication and information technology, people gradually realized that the contradiction between the limited resources and the business requirements of network cannot be fundamentally solved. In this paper, we design and develop a distributed security quality of service testing framework called AweQoS(AwesomeQoS), to adapt to the current complex network environment. This paper puts forward the necessity that some security tests should be closely combined with quality of service testing, and further discusses the basic methods of distributed denial of service attack and defense. We introduce the design idea and working process of AweQoS in detail, and introduce a bandwidth test method based on user datagram protocol. Experimental results show that this new test method has better test performance and potential under the AweQoS framework.

Edge computing is a distributed computing paradigm aiming at ensuring low latency in modern data intensive applications (e.g., video streaming and IoT). It consists of deploying computation and storage nodes close to the end-users. Unfortunately, being distributed and close to end-users, Edge systems have a wider attack surface (e.g., they may be physically reachable) and are more complex to update than other types of systems (e.g., Cloud systems) thus requiring thorough security testing activities, possibly tailored to be cost-effective. To support the development of effective and automated Edge security testing solutions, we conducted an empirical study of vulnerabilities affecting Edge frameworks. The study is driven by eight research questions that aim to determine what test triggers, test harnesses, test oracles, and input types should be considered when defining new security testing approaches dedicated to Edge systems. preconditions and inputs leading to a successful exploit, the security properties being violated, the most frequent vulnerability types, the software behaviours and developer mistakes associated to these vulnerabilities, and the severity of Edge vulnerabilities. We have inspected 147 vulnerabilities of four popular Edge frameworks. Our findings indicate that vulnerabilities slip through the testing process because of the complexity of the Edge features. Indeed, they can’t be exhaustively tested in-house because of the large number of combinations of inputs, outputs, and interfaces to be tested. Since we observed that most of the vulnerabilities do not affect the system integrity and, further, only one action (e.g., requesting a URL) is sufficient to exploit a vulnerability

S.6:1-6:13

Issues and Initiatives in the Testing Process in Primary Care Physician Offices

Effective monitoring and testing during each step are essential for document verification in research and development (R&D) projects. In software development, proper testing is required to verify it carefully and constantly because of the invisibility features of software. However, not enough studies on test processes for R&D projects have been done. Thus, in this paper, we introduce a Test Maturity Model integration (TMMi)-based software field R&D test process that offers five integrity levels and makes the process compatible for different types of projects. The Software & Systems Process Engineering Metamodel (SPEM) is used widely in the software process-modeling context, but it lacks built-in enactment capabilities, so there is no tool or process engine that enables one to execute the process models described in SPEM. Business Process Model and Notation (BPMN)-based workflow engines can be a solution for process execution, but process models described in SPEM need to be converted to BPMN models. Thus, we propose an approach to support enactment of SPEM-based process models by converting them into business processes. We show the effectiveness of our approach through converting software R&D test processes specified in SPEM in a case study.

Since at least 15 years, software testing has been one of the areas of software engineering that is increasing its importance in many organizations around the world. Due to this, guides, standards, and maturity models, such as the Brazilian Test Process Improvement model (MPT.Br), are gaining visibility to ensure that a company or organization, even a small one, has a quality level in their testing processes. Such models are important to ensure customer satisfaction and quality analysis of business processes in the production of a system. Given this context, this research aims to present the implementation of the MPT.br (in the first two maturity levels) in a telecommunications company in Brazil to present the benefits of defining the software test process according to a maturity model. To achieve the research goal, we are using a research method called action-research, which is based on empirical studies in software engineering. As results, we expect that this deployment in the company will contribute to a significant improvement in its testing processes, thus contributing to the improvement of the entire organization.

Towards an evaluation framework for Laboratory Information Systems.

Software is a complex thing. It is not an engineering artifact that springs forth from a design by simply following software coding rules; creativity and the human element are at the heart of the process. Software development is part science, part art, and part craft. Design, architecture, and coding are equally important activities and in each of these activities, errors may be introduced that lead to security vulnerabilities. Therefore, inevitably, errors enter into the code. Some of these errors are discovered during testing; however, some are not. The best way to find security errors, whether they are introduced as part of the architecture development effort or coding effort, is to automate the security testing process to the maximum extent possible and add this class of tools to the tools available, which aids in the compilation process, testing, test analysis, and software distribution. Recent technological advances, improvements in computer-generated forces (CGFs), and results in research in information assurance and software protection indicate that we can build a semi-intelligent software security testing tool. However, before we can undertake the security testing automation effort, we must understand the scope of the required testing, the security failures that need to be uncovered during testing, and the characteristics of the failures. Therefore, we undertook the research reported in the paper, which is the development of a taxonomy and a discussion of software attacks generated from the point of view of the security tester with the goal of using the taxonomy to guide the development of the knowledge base for the automated security testing tool. The representation for attacks and threat cases yielded by this research captures the strategies, tactics, and other considerations that come into play during the planning and execution of attacks upon application software. The paper is organized as follows. Section one contains an introduction to our research and a discussion of the motivation for our work. Section two contains a presents our taxonomy of software attacks and a discussion of the strategies employed and general weaknesses exploited for each attack. Section three contains a summary and suggestions for further research.

With the extensive application of informationalized management systems for barcode specimens, the degree of informatization is becoming higher and higher in medical laboratory. Informationalized management combines modern information technology and advanced management concepts, transforms or reengineers the laboratory operation and business process. Test specimen turnaround time (TAT) is an important factor affecting the quality of the inspection. By analyzing the test process of each time node, establish the suitable specimens monitoring program for clinical requirements and real-time monitor the key nodes in test processes,which will effectively shorten TAT, improve reporting timeliness rate and avoid clinical complaints.(Chin J Lab Med, 2014,37: 475-476) Key words: Laboratories, hospital; Management information systems; Clinical laboratory techniques; Total quality management

Compositional verification has long been regarded as an effective technique for extending the use of symbolic model checking to large, component-based systems. This paper explores the effectiveness of the technique for large-scale complex IT systems (LSCITS). In particular, we investigate how compositional verification can be used to reverify LSCITS safety properties efficiently after the frequent changes that characterise these systems. We identify several LSCITS change patterns--including component failure, join and choice--and propose an approach that uses assume-guarantee compositional verification to reverify probabilistic safety properties compositionally in scenarios associated with these patterns. The application of this approach is illustrated using a case study from the area of cloud computing.

Web application testing is concerned with numerous and complicated testing objects, methods and processes. So a testing framework fitting for the properties of Web application is needed to guide and organize all the testing tasks. Based on the analysis for Web application characters and traditional software testing process, the process for Web application testing is modeled, which describes a series of testing flows such as the testing requirement analysis, test cases generation and selection, testing execution, and testing results analysis and measurement. Furthermore, the realization techniques are also investigated so as to integrate each testing step and implement the whole testing process harmoniously and effectively. Thus the framework is suitable for the Internet environment and can guide the Web application testing actively and availably.

Software test maturity assessment and test process improvement: A multivocal literature review