Desktop Application - Test Plan Criteria
Following are the test criteria that desktop applications have to
meet in order to be issued the SI Tested seal.
Scope of Assessment
Our assessment focuses on the immediate application under test and
its environment. Items out of scope for this assessment include, but
are not limited to, the following:
 |
Backend systems |
|
|
Physical security of the customer site, servers, firewall configuration etc |
|
|
Effectiveness of failover or redundant systems, power protection, etc. |
|
|
Protection from insider threats from employees or others with physical or electronic access |
|
|
Review of internal IT security policy |
|
|
Social engineering, industrial espionage, etc. |
|
|
Review of documentation/requirements for compliance with laws, standards or certification programs |
Criteria
| 1.0 Authentication | |
| SUMMARY: Verify that the authentication mechanism is not subject to attacks aimed at bypassing it. | |
| A1. User cannot elevate privileges with malformed input A2. Passwords are stored securely A3. User identity is verified before resetting a password A4. Predefined passwords are unique and require reset A5. Only administrators can add, modify or delete user IDs A6. Lockouts are enforced with a limited duration A7. Strong passwords are enforced A8. Password renewal is enforced A9. Error pages do not give away usernames A10. SSL/TLS is used when transmitting credentials |
|
| 2.0 Cryptography | |
| SUMMARY: Verify that cryptography is well implemented. | |
| C1. Industry standard cryptographic methods are used C2. Sufficient key length is used |
|
| 3.0 Data Access | |
| SUMMARY: Verify that strong data access controls are in place. | |
| D1. The application protects data from malicious modification D2. The application protects data from being disclosed to unauthorized users D3. Connection strings to local databases conform to the principle of least privilege |
|
| 4.0 Error Handling | |
| SUMMARY: Verify error messages do not reveal confidential information | |
| E1. Error messages don’t contain internal application details | |
| 5.0 Input and Data Validation | |
| SUMMARY: Verify Input/Output is validated properly and securely | |
| I1. All user input is validated for type, length, format and range
I2. All input is properly encoded before being echoed back to the user I3. User supplied filename and path input is filtered |
|
| 6.0 Sensitive Data | |
| SUMMARY: Verify sensitive data is stored and encrypted properly. | |
| S1. Sensitive data is encrypted before being stored on the local
machine S2. Sensitive data is encrypted before being sent on the network |
|
| 7.0 Session Management | |
| SUMMARY: Verify tokens are formatted and sent securely. | |
| M1. Authentication tokens are transmitted over a secure connection
M2. Authentication tokens are not predictable |
|
