Security and Testing

Sauce AI for Test Authoring: Move from intent to executing in second.|xBack to ResourcesBlogPosted May 19, 2016

Security and Testing

Is your test environment secure? Do you cognise who has accession to your test data, your source code, your blueprint specification? There was a clip, backward in the day of stand-alone test systems and networks that were stringently local-area, when those questions would hold be easygoing to respond. A co-worker or two might have been look over your shoulder, but that would have been about it. These years, however, applications are break to the public web, and such enquiry can have serious implications for your software & # x27; s security and your fellowship & # x27; s bottom line. Software and IT companies may even hold physical locations, but much of the development and testing is done off-site, by employees, contractors, and services that transfer information over the Internet, such as cloud-based try result. That is why picking one who like about your application protection is crucial. Lets look at the risks, so at what a good resolution appear like.

Most companies are reasonably security-conscious when it comes to software growing, but do that protection consciousness extend to your examine process and suite? For many companies, using an Internet-based testing service only makes good sense from both a practical and economic point of view. But when your QA department dislodge its testing from in-house to online, do QA management and staff also shift their understanding of security from & quot; stand-alone machine safe behind four walls & quot; to & quot; somewhere out there on the Internet & quot;?

What & # x27; s at Stake

Consider what can be at stake if outside parties derive access to your test data or your tryout environment:

IP Theft

Unfortunately, not everybody in business sticks to the rules of fair play—and that includes the engineering sector. Noetic belongings is a worthful commodity, and for many technology providers, it is their chief asset. This is particularly true for smaller companies and startups, which may not have had clip to develop former assets, such as name-recognition or a reputation for high-quality production or services. IP is not hard to steal, since it generally consists of information that can be easy copy, compressed, encrypted, and transported. Often enough, sufficiently detailed (or still general) knowledge of an idea is sufficient for it to be stolen. If you are testing a feature or engineering that is deserving stealing, and if there is a way for IP stealer to gain access to your test environment, there is a reasonably good luck that they will break in. When that happens, you may chance yourself not just competing with knockoffs of your software-in-progress, but likewise defend in courtroom to find control of your proprietary technology and data.

Competitors

If you & # x27; re do anything worthwhile or potentially money-making, you hold competition—and if your competitors are voguish (which they nearly certainly are), they & # x27; re observe you. They may play a cleaner game than IP thieves, but they want to cognise what you & # x27; re planning, what new technology and services you & # x27; re in the process of implementing, how far along you are in developing them, and how good they & # x27; re working. Gratuitous to say, if they know what mistakes you & # x27; re making, they can learn from them as quick as you can. If your online examination environment is not unafraid, it & # x27; s possible that your competitors have admittance to your test results, and may even be able to mention your tests while they are in progression. A exam suite can give a sense of codification, functionality, and potential issues and weak spots in your application. They & # x27; ll know what new features and technologies will be in your next release, and they & # x27; ll have a head-start on adding compete versions to their own products. If they can memorize enough from watching you, they may even beat you to the market.

SUSA automates exploratory testing with persona-driven behavior, catching bugs that scripted automation misses.

Just Plain Privacy

Maybe you & # x27; re not testing anything that can be easily cloned by competitors or stolen. Maybe you & # x27; re working on things such as best implementations of known technology, and a new user interface that incorporate your brand-new, still-under-wraps fellowship logo. There nevertheless may be some major security matter to continue in mind when it get to online testing. Consider this all-too-familiar scenario: Hackers break into a site, dig out some attention-getting information, and spread it all over the Internet. Very often, it turns out that what was gently entertaining to the hackers is embarrassing or even damage to the people and arrangement touch by the leak. Do you want your upcoming feature list to get public knowledge while those features are still in the other development phase? Do you want your raw test datum posted for anybody to see? Do you need your pre-release bugs to become just another affair for lulz? Just one little break-in, into a non-secure test environment, could do all of that.

Looking for Security

How do you find a secure on-line test environment? What are the key elements of on-line examination security? Besides such basics as a unafraid test infrastructure and physical on-site protection, a really secure online test service (such as Sauce Labs) should provide a suite of strong test-oriented security features:

Dedicated, One-Time Virtual Machines.Each test VM should be birl up, expend only for a single test, and so destroyed. VMs should not be reprocess for multiple exploiter, or yet for multiple tests by the like user.
Untroubled Communication.Client communication with the examination scheme should be by secure VPN or tunneling. Client test scripts and information should only be cached temporarily on the test-system side, and ne'er stored. Only the current examination VM should be allowed to pass with the client.
No External Communication.All inbound channels of communication with the examination VM other than client VPN/tunneling access should be disabled.
No On-Site Storage of Test Data or Artifacts.Test data and other artifacts should never be stored at the test website. They should only exist in RAM on the exam waiter, and should be mail to the client via secure connection. If they are stored as part of the trial service, such depot should be in a secure cloud-based location, it should be for a circumscribed clip, and it should exclusively be at the client & # x27; s discretion.

If an on-line service does not proffer security features such as these, you can not number on it to provide you with a secure testing environment. A genuinely secure software testing service, on the early mitt, can guarantee that all of your test data will truly be for your eyes only.

Michael Churchman started as a scriptwriter, editor, and manufacturer during the anything-goes other years of the game manufacture. He spent much of the ‘ 90s in the high-pressure bundled software industry, where the move from waterfall to faster release was well under way, and near-continuous liberation cycles and automated deployment were already de facto touchstone. During that time he developed a semi-automated system for managing localization in over fifteen words. For the retiring ten eld, he has been regard in the analysis of software development processes and related engineering direction issues.