SSD Module 6

Secure Software Testing

Topics: Fuzzing, Contrasting Software Testing and Software Security Testing,

Functional Testing, Risk-Based Testing. Secure API development -OpenID connect, API
gateway security.

6.1: Contrasting Software Testing and Software Security Testing

Security Testing is a type of Software Testing that uncovers vulnerabilities in the system and
determines that the data and resources of the system are protected from possible intruders.
●​ It ensures that the software system and application are free from any threats or risks
that can cause a loss.
●​ Security testing of any system is focused on finding all possible loopholes and
weaknesses of the system that might result in the loss of information of the
organization.

Types of Security Testing

Security testing is important to check and sure that applications and systems are protected from
various threats. There are several types of security testing, each targeting specific vulnerabilities
and aspects of security.

Security testing includes various methods, each targeting specific vulnerabilities:

1. Vulnerability Scanning

It is a type of testing that uses automated tools to scan the system for known vulnerabilities and
weaknesses. It aims to detect patterns of vulnerabilities that are commonly exploited by attackers. By
performing vulnerability scans regularly, organizations can proactively address these vulnerabilities
before they become security risks.

2. Security Scanning

It involves identifying weaknesses in the network or system and then providing solutions to mitigate
these risks. It can be performed either manually or automatically, depending on the complexity of the
system. This process helps uncover potential weak points that could be exploited by attackers,
allowing for early intervention to secure the system.
3. Penetration Testing

Penetration Testing simulates an attack from a malicious hacker to identify vulnerabilities in the
system. This type of testing helps organizations understand how an attacker might exploit weaknesses
in the system. By performing penetration testing, organizations can see their system from an attacker’s
perspective and fix vulnerabilities before they are exploited in a real-world attack.

4. Risk Assessment

It involves analyzing the security risks that could affect the organization. Risks are categorized as low,
medium, or high, and this testing suggests controls and measures to minimize those risks. Risk
assessment helps prioritize actions by identifying the most critical threats and focusing efforts on
addressing them first, ultimately improving the overall security posture of the system.

5. Security Auditing

These is an internal inspection of the system to identify security defects. This can involve reviewing
system configurations, checking for weaknesses in the code, or conducting a line-by-line inspection of
the application’s source code. Security audits ensure that all security standards and protocols are being
followed and identify any gaps that need to be addressed.

6. Ethical Hacking

It is also known as white-hat hacking, when security professionals are hired to simulate attacks on the
system to identify vulnerabilities. Unlike malicious hacking, ethical hacking is done with the
organization’s consent to help improve system security. Ethical hackers use the same techniques as
malicious hackers to uncover weaknesses in the system, but their goal is to fix those flaws before they
can be exploited by actual attackers.

7. Posture Assessment

These will combine security scanning, ethical hacking, and risk assessments to provide an overall view
of the system’s security. It gives a comprehensive evaluation of the system's security by integrating
multiple testing methods, ensuring that no part of the security infrastructure is overlooked. This
assessment helps organizations understand their security readiness and take necessary actions to
strengthen their defenses.
8. Application Security Testing

These Testing focuses specifically on identifying vulnerabilities within the application itself. This
includes examining the application’s code, configurations, and dependencies to identify flaws that
could lead to security breaches. Regular application security testing ensures that the software does not
contain any weaknesses that could be exploited by attackers.

9. Network Security Testing

These testing targets the vulnerabilities in the network infrastructure, such as firewalls, routers, and
other network devices. This testing is crucial for identifying weaknesses that could allow unauthorized
access to the system. Network security testing helps ensure that the communication pathways between
devices are secure and that sensitive data is protected from cyber threats.

10. Social Engineering Testing

Social Engineering Testing simulates phishing, baiting, or other manipulative techniques used to
exploit human behavior to gain unauthorized access. This type of testing focuses on the human
element of security, ensuring that employees are aware of potential threats and know how to protect
themselves from such attacks. By testing employees with simulated social engineering attacks,
organizations can gauge the effectiveness of their security awareness programs and make necessary
improvements.

In addition to manual methods, tools like Nessus, OpenVAS, and Metasploit can automate and
simplify the process of security testing. These tools help speed up the identification of vulnerabilities
and reduce the risk of human error, making the testing process more efficient.

Types of Security Testing Tools

Security Testing includes specialized tools that enhance the efficiency and accuracy of security testing.
Key tools include the following mentioned bellow:
●​ SAST (Static Application Security Testing): Analyzes the source code to identify security
flaws without executing the program. It helps developers identify and fix vulnerabilities early in
the development process.
●​ DAST (Dynamic Application Security Testing): Tests running applications to identify security
vulnerabilities. It simulates real-world attacks like SQL injection or cross-site scripting (XSS)
and is typically used for web applications.
●​ IAST (Interactive Application Security Testing): Combines both static and dynamic testing to
provide real-time feedback during the application’s runtime. It offers deeper insights into the
security of the application by continuously monitoring code flow.
●​ SCA (Software Composition Analysis): Scans third-party libraries and dependencies used in
the application for known vulnerabilities, license issues, and outdated components.
●​ MAST (Mobile Application Security Testing): Focuses on identifying vulnerabilities in mobile
applications, including platform-specific security risks, session handling, and insecure data
storage.
●​ RASP (Runtime Application Self-Protection): Embeds security controls within an application
during runtime to detect and mitigate attacks in real-time. RASP tools protect applications by
automatically responding to security threats as they occur.
Goal of Security Testing

The Security Testing Goals which are mentioned bellow:

●​ To identify the threats in the system and measure the potential vulnerabilities of the system.
●​ To help in detecting every possible security risk in the system and help developers fix
security problems through coding.
●​ The goal of security testing is to identify vulnerabilities and potential threats in a system or
application and to ensure that the system is protected against unauthorized access, data
breaches, and other security-related issues. The main objectives of security testing are to:
●​ Identify vulnerabilities: Security testing helps identify vulnerabilities in the system, such as
weak passwords, unpatched software, and misconfigured systems, that could be exploited by
attackers.
●​ Evaluate the system's ability to withstand an attack: Security testing evaluates the system's
ability to withstand different types of attacks, such as network attacks, social engineering
attacks, and application-level attacks.
●​ Ensure compliance: Security testing helps ensure that the system meets relevant security
standards and regulations, such as HIPAA, PCI DSS, and SOC2.
●​ Provide a comprehensive security assessment: Security testing provides a comprehensive
assessment of the system's security posture, including the identification of vulnerabilities, the
evaluation of the system's ability to withstand an attack, and compliance with relevant
security standards.
●​ Help organizations prepare for potential security incidents: Security testing helps
organizations understand the potential risks and vulnerabilities that they face, enabling them
to prepare for and respond to potential security incidents.
●​ Identify and fix potential security issues before deployment to production: Security testing
helps identify and fix security issues before the system is deployed to production. This helps
 reduce the risk of a security incident occurring in a production environment.

Principle of Security Testing

Security testing follows seven core principles, often referred to as the CIA triad (Confidentiality,
Integrity, Availability) with seven basic principles of security testing:
1.​ Confidentiality: verifies that sensitive data is only accessible to authorized users,
often through encryption and access control mechanisms.
2.​ Integrity: Verifies that data remains unchanged and unaltered during storage or
transmission. Hash functions and checksums are commonly used to guarantee
integrity.
3.​ Authentication: Ensures that only authorized users can access the system. This
involves testing password policies, multi-factor authentication (MFA), and identity
verification mechanisms.
4.​ Authorization: Verifies that authenticated users can only access the resources and
data they are authorized to use, through mechanisms such as role-based or
attribute-based access control (RBAC and ABAC).
5.​ Availability: Ensures that the system remains functional and accessible, even under
heavy traffic or during a cyberattack, such as a Distributed Denial of Service (DDoS)
attack.
6.​ Non-Repudiation: Ensures that users cannot deny their actions in the system. Digital
signatures, audit logs, and transaction records are commonly used to guarantee
non-repudiation.
7.​ Resilience: Verifies the system’s ability to recover from incidents, such as system
crashes or attacks, by evaluating backup systems and response protocols.

Major Focus Areas in Security Testing

Security testing targets critical areas to ensure comprehensive protection:

●​ Authentication and Authorization: Testing the system's ability to properly authenticate

and authorize users and devices. This includes testing the strength and effectiveness of
passwords, usernames, and other forms of authentication, as well as testing the system's
access controls and permission mechanisms.
●​ Network and Infrastructure Security: Testing the security of the system's network and
infrastructure, including firewalls, routers, and other network devices. This includes
testing the system's ability to defend against common network attacks such as denial of
service (DoS) and man-in-the-middle (MitM) attacks.
●​ Database Security: Testing the security of the system's databases, including testing for
SQL injection, cross-site scripting, and other types of attacks.
●​ Application Security: Testing the security of the system's applications, including testing
for cross-site scripting, injection attacks, and other types of vulnerabilities.
●​ Data Security: Testing the security of the system's data, including testing for data
encryption, data integrity, and data leakage.
●​ Compliance: Testing the system's compliance with relevant security standards and
 regulations, such as HIPAA, PCI DSS, and SOC2.
●​ Cloud Security: Testing the security of the cloud.

Advantages of Security Testing

Security testing offers significant benefits that enhance system protection and user trust:
●​ Identifying vulnerabilities: Security testing helps identify vulnerabilities in the
system that could be exploited by attackers, such as weak passwords, unpatched
software, and misconfigured systems.
●​ Improving system security: Security testing helps improve the overall security of
the system by identifying and fixing vulnerabilities and potential threats.
●​ Ensuring compliance: Security testing helps ensure that the system meets relevant
security standards and regulations, such as HIPAA, PCI DSS, and SOC2.
●​ Reducing risk: By identifying and fixing vulnerabilities and potential threats before
the system is deployed to production, security testing helps reduce the risk of a
security incident occurring in a production environment.
●​ Improving incident response: Security testing helps organizations understand the
potential risks and vulnerabilities that they face, enabling them to prepare for and
respond to potential security incidents.

Disadvantages of Security Testing

Here are the Security testing challenges which are mentioned bellow:
●​ Resource-intensive: Security testing can be resource-intensive, requiring significant
hardware and software resources to simulate different types of attacks.
●​ Complexity: Security testing can be complex, requiring specialized knowledge and
expertise to set up and execute effectively.
●​ Limited testing scope: Security testing may not be able to identify all types of
vulnerabilities and threats.
●​ False positives and negatives: Security testing may produce false positives or false
negatives, which can lead to confusion and wasted effort.
●​ Time-consuming: Security testing can be time-consuming, especially if the system is large
and complex.
●​ Difficulty in simulating real-world attacks: It's difficult to simulate real-world attacks,
and it's hard to predict how attackers will interact with the system.

With cyberattacks becoming more easily happens, it’s important to perform thorough security tests
throughout the development process. This helps find vulnerabilities early on, preventing them from
being exploited later.
By following best practices, using the right tools, and working closely with security experts,
companies can create secure software that protects user data, meets regulatory standards, and builds
trust with customers.
6.2: Functional Testing Types
Functional testing ensures that the software behaves according to its requirements and specifications.
It focuses on what the system does (its functions) rather than on how it does it. Common functional
testing types in software include:

●​ Unit Testing: This is the lowest level of testing, performed by developers. Each unit (e.g. a
function, method, or class) is tested in isolation to verify that it works correctly. For example, a
unit test might call a function that parses user input and check that it returns the correct result.
Unit tests catch bugs early in development, and they are usually fast and automated using
frameworks like JUnit, NUnit, or pytest.​

Integration Testing: After individual units are verified, integration tests check how different
modules or components work together.

●​ For instance, integration testing might involve verifying that the data passed from a web form
is correctly stored in the database via the application’s API, often supported by Zoho
Integration [Link] level of testing can uncover interface mismatches, data format issues,
or configuration problems. Integration tests are typically slower and more complex than unit
tests because they involve multiple parts of the system.​

●​ System Testing: System testing tests the complete, integrated application as a whole. It checks
end-to-end scenarios across the full software stack, including interactions between subsystems,
hardware, databases, networks, and third-party services. For example, system testing a banking
app might involve logging in, making a transaction, and verifying the end result in the user’s
account statement. The goal is to confirm that the system meets all functional requirements in
 an environment similar to production.​

●​ Acceptance Testing: Also known as user acceptance testing (UAT), acceptance testing verifies
whether the software meets the business requirements and is ready for release. These tests are
often defined by stakeholders or end users and can be manual or automated. An example is a
client-led test where real users run through key workflows to validate that the software
addresses their needs. In some organizations, formal acceptance tests may include specific
performance or compliance criteria. Successful acceptance testing means the product is
considered acceptable for deployment.​

Each level of functional testing builds on the previous one: unit tests verify the building blocks,
integration tests check the connections, system tests validate the complete product, and acceptance
tests ensure it solves the intended problem. Together, they form a layered approach often depicted as a
testing pyramid, emphasizing many fast unit tests, fewer integration tests, and even fewer broad
system/acceptance tests.

Non-Functional Testing Types

Non-functional testing evaluates how the system performs under certain conditions, rather than just
what it does. These tests address quality attributes such as performance, security, usability, and
compatibility. Key non-functional testing types include:

●​ Performance Testing: Measures the speed, responsiveness, and stability of the application
under various workloads. It identifies bottlenecks and ensures the software meets performance
requirements. Common performance test subtypes include:​

○​ Load Testing: Simulates expected user traffic to verify that response times and
throughput remain within acceptable limits. For instance, load testing a website might
involve simulating thousands of users browsing products and adding items to their cart
simultaneously.​

○​ Stress Testing: Pushes the system beyond normal load (and often beyond its capacity)
to see how it behaves under extreme conditions. Stress testing might involve ramping
up user load until the system fails, to evaluate robustness and recovery.​

○​ Spike Testing: Similar to stress testing, but specifically applying sudden bursts of load
to test system reaction to traffic spikes (e.g., a flash sale on an e-commerce site).​

○​ Endurance (Soak) Testing: Verifies stability and performance over an extended period
under a typical load, checking for issues like memory leaks or resource exhaustion.​

○​ Scalability Testing: Assesses how well the system can scale up or scale out (e.g., by
adding hardware resources) to handle increased load.​

●​ Example: An online ticketing platform might be load tested by simulating 10,000 concurrent
 users buying tickets. The test would measure response times for searching events, processing
payment, and generating tickets to ensure no unacceptable delays occur.​

●​ Security Testing: Focuses on identifying vulnerabilities that could be exploited by attackers. It

includes checking for authentication issues, data encryption flaws, injection attacks, and other
security weaknesses. Typical security tests include penetration testing (ethical hacking),
vulnerability scanning (automated tools checking for known issues), and code reviews for
security flaws.​
​
Example: A security test might attempt to perform SQL injection on a login form to ensure
the application properly sanitizes inputs and does not allow unauthorized data access.​

●​ Usability Testing: Assesses the user interface and overall user experience. It involves real
users or UI experts interacting with the application to gauge ease of use, clarity of navigation,
design intuitiveness, and overall satisfaction. This type of testing uncovers issues like
confusing layouts, unclear instructions, or difficult workflows that could frustrate end users.​
​
Example: Conducting a usability session where representative users are given tasks (like
“create a new account” or “complete a purchase”) and observers note where users struggle or
get confused. Insights from these tests help designers improve the interface for better user
satisfaction.​

●​ Compatibility Testing: Ensures that the software works correctly across various hardware,
software, browsers, devices, and network environments. This includes cross-browser testing
for web applications, cross-platform testing for mobile apps (iOS, Android, different screen
sizes), and compatibility with different operating system versions or configurations.​
​
Example: A web app might be tested on Chrome, Firefox, Safari, and Edge browsers on both
Windows and macOS, as well as on mobile browsers, to verify that layouts and functionality
are consistent across all combinations.​

Non-functional testing often requires specialized tools. For instance, JMeter or LoadRunner for
performance/load testing, OWASP ZAP for security scanning, and BrowserStack or Sauce Labs for
browser/device compatibility testing.

Regression Testing
Regression Testing is the process of re-running previously executed test cases after software changes
(like new features, bug fixes, or enhancements) to ensure that existing functionality still works as
intended. Each time code is modified, there’s a risk that something else broke unintentionally.
Regression tests catch these unintended side-effects.

Typically, regression testing is largely automated. A regression suite can include unit tests, integration
tests, and automated UI tests that cover the core features of the application. Whenever a developer
merges a change, the CI/CD pipeline runs the regression suite. Any failures signal that a recent change
has broken something. Rapid feedback from regression tests helps teams fix defects before they reach
production.

Key Point: Regression testing helps maintain software quality over time. It’s often the largest single
cost of testing in a mature product. Effective regression testing involves continuously updating the test
suite to cover new cases and removing obsolete ones.

Smoke Testing

Smoke Testing (also known as “build verification testing”) is a quick, shallow set of tests run on each
new build to ensure the most critical functionalities work. The idea is to verify that the build is stable
enough for further testing. Smoke tests cover the “happy path” scenarios: they do not test every detail,
but rather check the major features.

For example, in an e-commerce app, a smoke test might involve: launching the app, logging in, and
performing a simple purchase. If any of these fail, the build is deemed too unstable, and further testing
is halted until the issues are fixed.

Smoke tests are usually automated and run as soon as a new build is deployed (for instance, after a
nightly build). They serve as a gatekeeper: passing smoke tests indicates that deeper testing (functional,
regression, etc.) can proceed on this build.

Sanity Testing

Sanity Testing is a rapid, focused test performed after receiving a software build with minor changes. It
checks specific functionality after updates or bug fixes. Think of sanity testing as a quick check to
ensure that particular changes or fixes work and haven’t broken related parts of the application.

For example, if a patch is applied to fix the search feature on a site, a sanity test might involve only
running through the search function with a few queries, verifying that search results now work. Sanity
testing is narrower in scope than smoke testing or regression: it targets one area of functionality rather
than the application as a whole.

The terms “smoke test” and “sanity test” are sometimes used interchangeably, but key differences are:

●​ Scope: Smoke tests cover broad critical features, while sanity tests focus on specific
components or fixes.​

●​ Depth: Smoke tests are shallow, sanity tests may go a bit deeper into a feature area.​

●​ When: Smoke tests are done on new builds, sanity tests are done on builds after minor changes.​

In practice, teams often automate smoke tests as part of the build pipeline and perform sanity checks
manually or with light automation when addressing small issues. Both help avoid wasting time on
unstable builds.
Usability Testing

While functionality and performance are critical, Usability Testing ensures the product is easy and
pleasant for real users. This involves evaluating factors like:

●​ Ease of Use: How intuitively can users navigate the interface? Are instructions clear?​

●​ Accessibility: Does the software cater to users with disabilities (e.g., screen-reader
compatibility, color contrasts)?​

●​ User Satisfaction: Are users comfortable and satisfied when completing tasks?​

Usability testing often involves observing real users as they interact with the software. Testers might
ask users to perform common tasks (like signing up, finding information, or completing a transaction)
and note any difficulties or confusion. Surveys and feedback sessions can supplement these
observations.

Example: A usability test for a financial app might reveal that users struggle to locate the button for
transferring funds. Developers could then redesign the navigation based on this feedback.

Integrating usability testing early (and repeatedly) in the development cycle can significantly enhance
user experience, reduce errors, and increase customer satisfaction.

Compatibility Testing

Software can run in many environments, and compatibility testing makes sure it works everywhere it’s
supposed to. Key areas include:

●​ Browser Compatibility: For web apps, tests across Chrome, Firefox, Edge, Safari, etc., on
different OS.​

●​ Operating Systems: Ensuring desktop software runs on Windows, Linux, macOS (with correct
versions).​

●​ Mobile Platforms: Verifying iOS and Android compatibility across various device models and
screen sizes.​

●​ Hardware: For specialized software, checking compatibility with different hardware

configurations, drivers, or printers.​

●​ Network Conditions: Testing under different bandwidths, latencies, or offline modes.​

In compatibility testing, it’s common to use device farms or virtualization tools so you can run tests on
many environments without owning every device. The goal is to catch issues like UI layout breakages,
missing functionalities, or performance problems that only appear in certain environments.

Security Testing

With increasing cyber threats, Security Testing is non-negotiable. This type of testing uncovers
vulnerabilities that could be exploited, risking data breaches or downtime. Key security tests include:

●​ Penetration Testing: Ethical hackers simulate attacks to find security holes. For example, they
might attempt SQL injection on input fields or try to bypass authentication.​

●​ Vulnerability Scanning: Automated tools scan the system for known vulnerabilities,
misconfigurations, or outdated libraries.​

●​ Security Audits: Reviews of code, architecture, and processes to ensure compliance with
security standards.​

●​ Fuzz Testing: Feeding random or invalid inputs to the application to see if it crashes or behaves
insecurely (e.g., buffer overflows).​

●​ Access Control Testing: Verifying that users have appropriate permissions and that sensitive
data is properly protected.​

Example: For a healthcare app, security testing might involve ensuring that patient data is encrypted at
rest and in transit, and that only authorized roles can access personal information.

Security testing often requires specialized expertise and may be performed by a dedicated team or
third-party specialists. It should be repeated regularly, especially after major changes, to guard against
new vulnerabilities.

Performance and Load Testing

As briefly discussed under performance testing, Load Testing is a critical subtype focusing on
evaluating how the system performs under realistic and peak loads. Its primary goals are:

●​ Response Times: Measuring how fast the application responds under expected user loads.​

●​ Throughput: Determining the number of transactions or requests the system can handle per
unit time.​

●​ Resource Utilization: Checking how much CPU, memory, or network the system uses under
load.​

●​ Scalability: Verifying if adding more resources (servers, database instances) improves

performance as expected.​
In load testing, simulated users or requests are generated (often using tools like Apache JMeter,
Gatling, or LoadRunner) to mimic real-world usage. For example, a social media platform might run a
load test with 50,000 concurrent users posting updates, to ensure response times stay within acceptable
limits.

Stress Testing is related but goes beyond normal loads to find the breaking point. It helps plan for
unexpected spikes or ensure graceful degradation under overload (e.g., returning useful error messages
rather than crashing).

Performing thorough performance, load, and stress tests helps businesses prepare for high-traffic events
(like Black Friday sales or major product launches) and ensures a smooth user experience.

Usability Testing (Detailed)

While usability was mentioned above, it’s worth highlighting why usability testing matters for QA
and decision-makers. It helps answer: Will end users find this product intuitive and efficient? By
catching usability issues early, you can avoid costly redesigns or negative user feedback after launch.
Common steps in usability testing include:

●​ User Interviews: Collecting initial requirements and expectations from the target audience.​

●​ Prototype Testing: Even mock-ups or beta versions can be tested to refine the UI/UX design.​

●​ Task-Based Testing: Giving users specific tasks (like “buy a product” or “find a setting”) and
observing their success and time taken.​

●​ Heuristic Evaluation: Experts review the interface against established usability principles (like
Nielsen’s heuristics).​

Ultimately, better usability leads to higher customer satisfaction and retention, which is critical for
business success.

Sanity vs. Smoke: Comparing Quick Checks

To recap and contrast smoke testing and sanity testing:

●​ Smoke Testing: Broad, shallow, and usually automated. It checks core functionality after a new
build. If smoke tests fail, the build is discarded.​

●​ Sanity Testing: Narrower, deeper for a specific area. It verifies recent changes or bug fixes on a
stable build. Sanity tests may be manual or scripted but focus only on the impacted parts.
Fuzz Testing - Software Testing
Fuzz Testing is a Software Testing technique that uses invalid, unexpected, or random data as
input and then checks for exceptions such as crashes and potential memory leaks. It is an
automated testing technique that is performed to describe the system testing processes involving
randomized or distributed approaches. During fuzz testing, a system or software application can
have a lot of different bugs or glitches related to data input. Barton Miller at the University of
Wisconsin in 1989 first developed fuzz testing, also known as fuzzing, which is a type of
software testing that involves providing invalid, unexpected, or random data as inputs to a
system to identify potential security vulnerabilities or crashes. The goal of fuzz testing is to
identify issues that can be exploited by an attacker, such as buffer overflows, SQL injection, or
other types of input-validation issues.

Fuzz testing can be done in a variety of ways, including:

●​ File fuzzing: providing random or malformed data as inputs to a file-parsing function

to identify issues such as buffer overflows or other memory-corruption issues.
●​ Network fuzzing: sending malformed or unexpected data as inputs to a network
protocol to identify issues such as denial of service (DoS) attacks or other security
vulnerabilities.
●​ API fuzzing: sending random or unexpected data as inputs to an application
programming interface (API) to identify issues such as input validation issues or other
security vulnerabilities.
●​ Fuzz testing is an important aspect of software testing, as it can help to identify
potential security vulnerabilities that may not be apparent during functional or unit
testing. It can also help to identify issues that may not be immediately apparent
during functional testing, such as memory leaks or other performance issues.

It is essential to note that fuzz testing may require specialized tools and test environments and
that it's often a costly and time-consuming process. Additionally, it may require a thorough
understanding of the system's architecture, protocols, and data format.

The objective of Fuzz Testing:

The objectives of the Fuzz Testing are:
 ●​ To check the vulnerability of the system or software application.
●​ To detect security faults and defects.
●​ To determine the defects in effective cost.

Phases of Fuzz Testing:

1.​ Identify Target System: The system or the software application which is going to be
tested is marked. That system is known as the target system. Target system is
 identified by the testing team.
2.​ Identify Inputs: Once the target system is set after that the random inputs are created
for the purpose of the testing. These random test cases are used as inputs to test the
system or software application.
3.​ Generate Fuzzed Data: After getting the random inputs i.e. unexpected and invalid,
these invalid and unexpected inputs are converted into the fuzzed data. Fuzzed data is
basically random input in the form of fuzzy logic.
4.​ Execute the test using fuzzed data: Now using the fuzzed data testing process is
performed. Basically in this section, the code of the program or the software is
executed by giving the random input i.e. fuzzed data.
5.​ Monitor System Behaviour: After the execution of the system or the software
application, operated for crashes or any other exceptions like potential memory leaks.
System behaviour is tested under the random input.
6.​ Log Defects: In the last phase defects are identified, and these defects are fixed in
order to get a better quality system or software application.

Types of Fuzz Testing

There are many types of Fuzz testing, two major categorization of fuzz testing are -
1. Coverage-guided fuzz testing - In order to find flaws, coverage-guided fuzz testing examines
the source code while the application is operating, probing it with arbitrary challenges. The
objective is to cause the program to crash, and new tests are generated continuously. A crash
indicates a possible issue, and information gathered during the coverage-guided fuzz testing
process can be used to replicate the crash, which is useful in locating code that may be at risk.
2. Behavioral Fuzz testing - Behavioral fuzzy testing operates in a distinct way. When an
application's specs demonstrate how it should function, random inputs are used to evaluate how
well it really performs; defects or other possible security issues are typically discovered in the
gaps between expectations and reality. Some other types of fuzz tests are-
1.​ Mutation Fuzzing - To evaluate the robustness of the program, it randomly modifies
valid input data by flipping bits, adding or removing characters, or making small
adjustments.
2.​ Web fuzzing - It is the process of applying fuzzing techniques to web applications
through the use of manipulated URL parameters, forms, or HTTP requests.
3.​ Generation Fuzzing - It starts with zero input data and frequently generates it
according to the target's input requirements.
4.​ Smart Fuzzing - It employs sophisticated algorithms to direct and prioritize the
fuzzing process, resulting in a more effective bug finding procedure.
5.​ Protocol fuzzing - It involves providing unexpected or erroneous data packets to test
network protocols and communication.

Types of defects detected by Fuzz Testing:

1.​ Number Fuzzing
 2.​ Character Fuzzing
3.​ Application Fuzzing
4.​ Protocol Fuzzing
5.​ File Format Fuzzing.

Fuzz testing applications

1.​ Blockchain - Fuzz testing of smart contracts uncovers vulnerabilities preventing
financial losses or other security issues.
2.​ API - Fuzz testing of API helps in ensuring the ability to handle workload and
frequent requests.
3.​ Operating System - Fuzz testing of OS helps to ensure if system call is handled
correctly and prevent system crashes.
4.​ Quality Assurance - Fuzzing ensures that programs can accept erroneous or
unexpected inputs without crashing QA tests software under a variety of
circumstances to make sure the program continues to work even under pressure.
5.​ Cryptography - Fuzz testing easily tests the cryptographic algorithm over various
combinations and maintains security and integrity.

Advantages of Fuzz Testing:

Fuzz testing has several advantages as a method for identifying potential security vulnerabilities
and other issues in software systems. Some main advantages of fuzz testing include:
●​ Automation: Fuzz testing can be automated, allowing for large numbers of inputs to
be tested quickly and efficiently.
●​ Coverage: Fuzz testing can cover a wide range of inputs, including unexpected or
invalid data, making it more likely to uncover issues that may not be found through
other testing methods.
●​ Cost-effective: Fuzz testing can be a cost-effective method for identifying potential
security vulnerabilities, as it can be automated and does not require manual testing.
●​ Early detection: Fuzz testing can detect vulnerabilities early in the development
process, before the software is released to users, making it easier and less expensive
to fix the identified issues.
●​ Dynamic: Fuzz testing can be dynamic, meaning that it can adapt to different systems
and can be used to test different types of inputs, such as network protocols, file
formats, and APIs.

Disadvantages of Fuzz Testing:

Fuzz testing has some limitations and disadvantages as well. Here are some of the main
disadvantages of fuzz testing:
 ●​ False positives: Fuzz testing can generate a high number of false positives, meaning
that it may report issues that are not actually vulnerabilities.
●​ Limited scope: Fuzz testing is limited to testing inputs and may not uncover all types
of vulnerabilities or issues. For example, it may not be able to detect issues related to
concurrency or race conditions.
●​ Limited understanding: Fuzz testing may not have a deep understanding of the
system being tested, and may not be able to identify all possible inputs or test cases.
●​ Limited to input validation issues: Fuzz testing is mainly focused on input
validation issues, and may not be able to detect other types of vulnerabilities such as
logical bugs or security misconfigurations.
●​ May cause crashes: Fuzz testing can cause the system to crash or hang, which can
make it difficult to continue testing and may require manual intervention to recover
the system.

It's important to keep in mind that fuzz testing is just one technique among many, and it should
be used in combination with other testing methods such as manual testing, code review, and
static analysis to have a complete view of the system security.

6.3: Secure API development -OpenID connect, API gateway security.

A centralized way to manage APIs

APIs are everywhere today, allowing various software systems to communicate in ways that
power our increasingly connected world. APIs, or application programming interfaces, provide a
set of rules and tools that enable diverse software programs written in different languages to
exchange information and share functionality. API gateways provide a centralized point for
managing, securing, and optimizing API calls — both requests and responses.

Because they are critical to so many processes and often connect to sensitive data, APIs have
become a favorite target of malicious actors. As a result, security teams must adopt protocols,
practices, and measures that ensure API gateway security and protect the underlying
microservices and back-end services that APIs support.

What is an API?

An API is a set of protocols and definitions that allow software components from different
systems or written in different languages to nevertheless communicate easily and share
information. By standardizing the way that applications communicate, APIs allow one
application to access and incorporate data and functions provided by another application. For
example, when developers want to include the latest weather information on a website, they can
use an API to access data from a weather-related source rather than creating their own separate
application to collect and interpret weather data. APIs are involved in almost every online action
and transaction, from ecommerce and mobile payments to social media platforms and cloud
services, which means they create a large attack surface.

What are threats to APIs?

Hackers now target APIs because they often provide access to sensitive data or may allow
attackers unauthorized access to larger systems. With the rapid proliferation of APIs, security
teams often are unaware of all the APIs in their organization’s digital ecosystem, making it more
difficult to adequately protect each API with security controls and regular patches and updates.
API security can be jeopardized by a variety of risks, including vulnerability exploits,
authorization errors, authentication issues, and denial-of-service attacks.

What is an API gateway?

An API gateway is a layer of software that serves as a single entry point for managing API calls
or client requests and returning responses from API endpoints. API gateways route incoming
requests to the appropriate microservice or back-end service, combining multiple requests into a
single request or splitting single requests into multiple requests to fulfill a client’s need most
efficiently. API gateways also translate protocols between different apps and microservices and
may serve as a load balancer to optimize API performance.

What is API gateway security?

An API gateway can perform a broad range of security functions to prevent API abuse and attacks, and
enhance an organization’s security posture.

●​ Authentication. API gateways may validate credentials such as ID tokens to authenticate the
identity of all API requests.
●​ Rate limiting and throttling. API gateway security measures include the ability to limit the
number of times an API can be called within a specific period of time to ensure that processing
capacity is not exceeded or overwhelmed. This helps prevent denial-of-service attacks, as well
as brute-force attacks and trial-and-error attacks, where hackers attempt to access systems by
 repeatedly trying various credentials.
●​ Policy enforcement. API gateways can enforce policies and rules — especially around
authentication, authorization, and access control — to be followed when accessing
microservices and back-end services.
●​ Signature-based protection. APIs can block certain threats by recognizing the signatures and
patterns of known attacks.
●​ Logging and monitoring. API gateways enable continuous monitoring of API traffic and
metrics around API usage. Gateways may also maintain a log of all transactions that provides
insight into usage and security issues.
●​ Decoupling. To enhance security, an API gateway decouples back-end services from front-end
applications to eliminate any direct contact between them. This can help to block SQL injection
attacks, where malicious code is injected into back-end databases.

How effective is API gateway security?

While API gateways are an important part of a security program, they are only one layer of protection,
so some security vulnerabilities remain a threat. Attacks like Broken Object Level Authorization
(BOLA) may appear as normal traffic to an API gateway, leaving systems vulnerable to BOLA and
Broken Object Property Level Authorization (BOPLA) attacks. Gateways also do not provide sufficient
visibility into API inventory to ensure security teams are aware of all APIs, and that each API is
protected by appropriate controls and policy. For this reason, many organizations use additional API
protection solutions in concert with an API gateway to improve visibility of the attack surface.

What are API gateway security best practices?

Organizations and their security teams can improve API gateway security by adhering to these best
practices.

●​ Centralize authentication. By centralizing API authentication at the gateway, organizations

can minimize the risk of each microservice attempting independently to manage access, token
verification, and other elements of the authentication process, which can lead to complexity and
security gaps.
●​ Implement rate limiting. Controlling the number of API requests can prevent excessive
requests — both malicious or legitimate — from overwhelming services and from succumbing
to DoS or DDoS attacks.
●​ Monitor continuously. Continuous monitoring and analytics can help to detect potential threats
and solve client access and request issues.
●​ Remove unused and deprecated APIs. Security teams can enhance API gateway security by
keeping track of all APIs and removing APIs that are no longer used or that no longer support
the latest security measures.
●​ Enable a web application firewall (WAF). Deploying a WAF in networking and API security
programs can block common threats like injection attacks and cross-site scripting by limiting
access to APIs based on defined rules and conditions.
●​ Leverage behavioral analytics. A SaaS-based behavioral analytics solution can record all API
activity to determine a baseline for normal behavior. Then it can alert potential threats and
recommend defensive or proactive responses.
How is API Security Different from Application Security?
Users typically interact directly with applications, while APIs are utilized behind the scenes for
software-to-software connections. Application security protects the application itself, while API
security focuses on APIs and their transactions with other APIs.

Applications used to be the primary entry point to an organization and its data, but the
proliferation of APIs has added a new attack surface that attackers can exploit. While attackers
may previously have focused on applications, they now often attack the underlying APIs directly.
This has required organizations to employ API security controls in addtion to the application
security tools and processes they likely already had in place.

What Types of APIs are Common?

There are several types of APIs developed over the years for different types of data and transactions.
Some of the most common include:

●​ SOAP – a mature, XML-based API architecture used when security and reliability are
important, such as in financial services. It’s also complex and verbose and perhaps not an ideal
choice when speed is a factor.
●​ REST – an architecture built on top of HTTP methods that is widely-used by web services such
as YouTube. It’s easy to implement, but not the best API to use for real-time data.
●​ GraphQL – originally developed by Facebook, it allows clients to ask for specific data,
eliminating over- or under-fetching. It’s fast and efficient, making it an excellent choice for
applications with granular data requirements.
●​ gRPC – a modern, high-performance architecture ideal for microservices.

Establish the Secure API Connection

To establish a secure API connection, follow these essential steps:

Step 1: Choose the Right Authentication Method

●​ OAuth 2.0: This method is ideal for user authentication and authorization, providing a
robust framework for secure access.
●​ API Keys: While straightforward to implement, API keys are less protected; they are best
suited for server-to-server communication where risks are minimized.
 ●​ JWT: Utilize JSON Web Tokens for stateless authentication, ensuring a safe and efficient
user experience.

Step 2: Implement HTTPS

●​ It is crucial to ensure that all API calls are made over HTTPS to encrypt data in transit.
This measure prevents eavesdropping and man-in-the-middle attacks, thereby
safeguarding sensitive information. Notably, in 2025, the average response time for Open
Banking interfaces was recorded at 342 milliseconds, underscoring the need for efficient
and secure connections.

Step 3: Configure API Gateway

●​ Leverage an like Gravitee to manage traffic and enforce security policies. Configure it to
require authentication for all incoming requests, ensuring that only authorized users can
access your APIs. Gravitee's features can assist in optimizing this process, improving
protection and governance.

Step 4: Set Up Rate Limiting

●​ Implement rate limiting to prevent abuse and denial-of-service attacks. This can be
configured in your API gateway settings, helping to maintain service availability and
performance.

Step 5: Monitor API Activity

●​ Utilize monitoring tools to track API usage and detect any unusual activity. This
proactive approach aids in identifying potential security threats early, allowing for timely
interventions. For instance, in August 2025, there were over 13 million failed API calls to
Open Banking APIs, highlighting the importance of vigilant monitoring and error
handling in maintaining API integrity. Implementing HTTPS can significantly lower the
risk of such failures by guaranteeing protected data transmission.
Additionally, consider engaging with the Gravitee community for support and resources related
to API management and security. Participating in certification programs can further enhance
your understanding and skills in utilizing Gravitee's platform effectively.