When testing online sales and marketing software for vulnerabilities, is there a particular testing technique that should be used?
Requires Free Membership to View
When you register, you'll receive targeted emails designed to keep you informed of the most relevant information on Agile development, application security, testing & QA, software requirements, and more.
Hannah Smalltree, Editorial Director
In general, no, there isn't a particular security testing technique for online sales and marketing software. The same vulnerabilities that affect all online applications apply the same for sales or marketing.
I will say, though, that the type of data that is considered "sensitive" changes. For example, marketing websites usually have a location where the public can view press releases. With many of these websites, when you view the press release and look at the URL will see something similar to this:
http://marketingsite.com/pressrelease.aspx?id=23
A common vulnerability that can exist here is that an attack can gain access to the press release before it is released to the public by just incrementing the ID in the URL, e.g., http://marketingsite.com/pressrelease.aspx?id=24, which although not public yet can now be viewed. I don't have to explain to you the impact of what that can cause.
I will say, though, that the type of data that is considered "sensitive" changes. For example, marketing websites usually have a location where the public can view press releases. With many of these websites, when you view the press release and look at the URL will see something similar to this:
http://marketingsite.com/pressrelease.aspx?id=23
A common vulnerability that can exist here is that an attack can gain access to the press release before it is released to the public by just incrementing the ID in the URL, e.g., http://marketingsite.com/pressrelease.aspx?id=24, which although not public yet can now be viewed. I don't have to explain to you the impact of what that can cause.
This was first published in December 2008