Overview

Software information security testing is a testing service that verifies and evaluates a software product in the areas of authentication, access control, data protection, interface security, log auditing and exception protection, based on the software requirement specification, product description, user documentation, security requirements and applicable standards. The focus includes whether the software can prevent unauthorised access, whether it protects program and data security, whether it manages access permissions effectively, and whether it protects sensitive data.

Information security testing helps clients identify risks in account permissions, identity verification, session management, interface access, data transmission, file upload, input validation, sensitive information protection and security configuration, reducing security exposure during system launch, delivery and operation.

The Value of Information Security Testing

Information security testing is an important element of software quality evaluation. It gives clients a third-party view of the software’s security protection capability and identifies issues that may lead to data leakage, unauthorised access, illegal tampering, identity impersonation, missing logs and exposed interfaces.

For government bodies, enterprises and institutions, research institutes and software project owners, information security testing can be used for software acceptance, project delivery, security confirmation before system launch, remediation retesting and quality evaluation, providing technical support for project management and security risk control.

Testing Basis and Evaluation Dimensions

According to GB/T 25000.51-2016, Systems and software engineering — Systems and software Quality Requirements and Evaluation (SQuaRE) — Part 51: Requirements and testing details for ready-to-use software products (RUSP), the security of software product quality can be evaluated mainly from the following aspects:

Confidentiality

Verify whether the software ensures that data can only be accessed when authorised. The focus includes authentication, password policy, access control, role permissions, display of sensitive information, encryption of data in transit and protection against unauthorised access.

Integrity

Verify whether the software prevents programs or data from unauthorised access, creation, modification or deletion. The focus includes interface parameter tampering, unauthorised operations, illegal input, file upload, protection of database or file integrity, and the system’s ability to identify and handle abnormal operations.

Non-repudiation

Verify whether the software records key activities or events so that the relevant operations can be traced and proven afterwards. The focus includes operation logs, audit records, traceability of key business operations, log integrity and resistance to log tampering.

Accountability

Verify whether system activity can be uniquely traced to the corresponding user, process or operating subject. The focus includes account uniqueness, login records, session management, coverage of audit events, completeness of log content and the ability to trace abnormal events.

Authenticity

Verify whether the identity of users, objects or resources can be proven to match what they claim to be. The focus includes user identity verification, access history records, user lists, login logs, abnormal access records and the effectiveness of authentication mechanisms.

Testing Methods

Depending on the characteristics of the software under test, Star River Quality Co., Ltd. can apply functional verification, vulnerability scanning, simulated attacks and security penetration testing to evaluate the information security quality of a software product. For web application security testing we can use Burp Suite for request interception, parameter analysis, weakness detection, authentication and session checks, privilege escalation verification and common web vulnerability testing.

Testing can cover SQL injection, cross-site scripting, file upload risks, unauthorised access, sensitive information leakage, broken authentication, session management flaws, security misconfiguration, unauthorised access, redirect risks and interface parameter tampering.

Information security testing is carried out only after written authorisation from the client. During testing we control the testing intensity according to the authorised scope and objectives, avoiding unnecessary impact on the business system.

Our Capabilities

With a professional software evaluation team and standardised testing processes, Star River Quality Co., Ltd. provides third-party software information security testing for government bodies, enterprises and institutions, research institutes and software development companies.

We prepare a test plan to the project’s needs and carry out authentication testing, permission control testing, interface security testing, data security testing, log audit checks, Burp Suite web security testing and verification of common vulnerabilities, recording, analysing and reporting the issues found.

After testing, Star River Quality Co., Ltd. can issue a CNAS software test report as required by the project, for software acceptance, project delivery, system launch, security remediation, quality evaluation and related management scenarios, providing clients with objective, standardised and credible evidence for software information security evaluation.