Security testing is a software testing process that analyses computer security mechanisms to uncover flaws or vulnerabilities that may result in security threats. In addition, it ascertains if a system's defence mechanism efficiently protects data from hacking as required. Security testing is the bedrock of Cybersecurity, which shields computer systems from malicious attacks.
It is a form of Software testing, which as the name implies, is the process of analysing software to determine suitability for its intended use. Functional testing focuses on how well the software performs its operations, while non-functional analyses other operations. A typical non-functional testing operation is Security Testing, which this article discusses extensively, covering the following:
Before proceeding, we should refresh our familiarity with common terms encountered when discussing Security testing.
Vulnerability: Vulnerability is any weakness in an IT system that an attacker can successfully exploit to gain unauthorised access.
Exploit: An exploit is a tool with which an intruder capitalises on vulnerabilities. This could be code, software, commands, or in a single word, Malware. The act of using exploits successfully is also referred to as exploitation.
Threat: A threat describes the scenario where an intruder embarks on an exploit. A vulnerability that has been exploited is referred to as a threat.
Asset: These are items of value to an organisation. They may be sensitive documents, customer information, passwords, etc.
Risk: A risk is the potential damage a threat poses to the organisation's assets.
Malicious: This defines the intent to cause harm or damage to a software system or application.
Malware: This is any malicious software program used by attackers to exploit vulnerabilities. Examples include keyloggers, spyware, adware, ransomware, viruses, etc.
OWASP: Open Web Application Security Project is a global non-profit charitable organisation comprising an online community of corporations, educational organisations, and individuals committed to providing global tools, resources, and information to improve software security.
Security testing simulates a malicious attack against the subject software or system to uncover and remediate vulnerabilities.
It involves scanning for known software vulnerabilities and attempting to exploit them. Developers then implement the outcome of these tests to remediate those loopholes and strengthen the security mechanism. Security testing can be carried out on newly developed software before its deployment or on existing software. In addition, some forms of security testing take place even before entirely developing the applications.
The standard testing methodologies are:
Black-box security testing aims to uncover and exploit vulnerabilities from outside the network. In this case, the attacker attempts this exploit blindly, with no inside information on source code, IP configurations, and other relevant data. It is a simulation of an attack by a random hacker to obtain sensitive information or penetrate the security system.
Here, the hacker is equipped with full access to the application, source code, and other information. It aims to determine and exploit vulnerabilities in a system that are exploitable from both inside and outside.
Grey-box security testing combines black-box and white-box methodologies. As a result, the attacker is equipped with partial access to a network’s internal workings to cover all threat possibilities.
According to OWASP, the ten commonly known security vulnerabilities are :
Injection occurs when an attacker exploits a security loophole by inserting their code into a program, imitating an intended user, and gaining unauthorised access to confidential information. Examples of injections include SQL injections, command injections, CRLF injections, and LDAP injections.
In poorly implemented authentication and session management calls, attackers can easily gain access to the system under the guise of legitimate users' identities.
When an API relies on insecure data transmission methods, attackers can exploit it to gain unauthorised access to sensitive information like usernames, passwords, and customer data.
This occurs when an attacker exploits insecure code or integrations to upload malicious XML content.
Access control systems oversee access to information and functionality. However, if adequate authentication and access restrictions implementation fails, attackers can circumvent authorisation to imitate privileged users.
Flaws in security configuration can give attackers easy unauthorised access to the system and its sensitive data.
This vulnerability occurs when a web application permits users to input custom code into a URL path that other users can see. This allows an attacker to run malicious code on a browser, hijack user accounts and access histories, remotely control the browser, or spread Trojans and worms.
Deserializing data from untrusted sources can result in an attacker using untrusted data to manipulate an application, initiate a denial of service (DoS) attack, or remotely execute code or commands to influence the behaviour of a system.
Many APIs and other third-party components carry well-known vulnerabilities. As a result, they are susceptible to exploitation at any given time.
Poor monitoring practices, such as incompetent logging of errors or attacks, can result in exploitation and data breaches.
To grasp just how necessary Security testing is, you only need to look at the grave potential of damage a data breach can result in. For example, a ransomware attack can lock you out of your system, either permanently or until you pay a ransom.
In light of the statistics report that 560,000 pieces of malware are detected daily, you cannot afford to leave your software security to the mercy of assumptions and luck. Cyber attacks are so prominent today that nobody is above the threat of exploitation.
In July 2022, the Shanghai police reportedly suffered arguably the most massive data breach in history when a database containing 500 million records of Chinese citizens were stolen from their system. In another instance, Facebook lost 533 users’ phone numbers, which were leaked online in a low-level hacker forum.
Microsoft also lost 240 million customer support records which had been left without password protection.
These show that even the big boys are not immune to malicious attacks. While Microsoft, Facebook, and the like can afford to get away with these losses, many startups cannot.
This is unfortunate because 43% of malicious attacks are aimed at small businesses, out of whom only 14% have their software security effectively protected. In 2021, the average cost of a ransomware attack was $1.85 million, and the average cost of a general data breach was $ 4.217 million.
Beyond the financial aspect, security testing also seeks to protect six principal values.
Confidentiality: An organisation should keep customers' information private and secure.
Integrity: Integrity ensures that data records and files are immune to corruption, modification, or deletion.
Availability: This is the simple, straightforward provision of customer information as soon as needed.
Authorisation: This determines the level of user privileges or access to data, files, or services.
Authentication: This verifies the validity or identity of a person or entity seeking access.
Non-repudiation: This is the ability to prove the identity or source of a user or individual performing a particular action.
Any shortcomings in implementing these principles can be directly detrimental to an organisation and may result in loss of information and revenue, damage to the reputation and continuity of the brand, as well as legal liability.
This involves using scanning tools to identify weaknesses, flaws, or loopholes in software security systems.
This is a process of imitating malicious attacks against a security system to uncover weaknesses and attempt to exploit them. Penetration testing is done to evaluate defence systems without causing damage. It can be done by trusted hackers or freelancers who carry out the operation and reach out to the organisation.
This process identifies assets, their value to the organisation, their vulnerabilities, and threats to them. It also measures the magnitude of the consequences of a successful exploit and the cost of remediation.
This process is done by probing for flaws in system configurations. These misconfigurations can be hunted down using manual or automated tools.
This involves reviewing security practices according to industry-accepted standards. It usually entails a review of codes, audit logs, configurations, and operating systems to verify if they meet published requirements.
This is the process of analysing the security system of an application to uncover flaws and vulnerabilities. It aims to identify weaknesses before deploying the application or the earliest possible remediation after launch. The types of application software testing are:
● Static Application Security Testing (SAST)
SAST is used to secure applications by reviewing the source code to uncover vulnerabilities when it’s not running. It is a white-box testing method.
● Dynamic Application Testing (DAST)
DAST identifies potential security vulnerabilities by simulating different attack types against the application while running. DAST tools do not require access to source code and fall under black-box testing.
● Interactive Application Security Testing (IAST)
IAST combines SAST and DAST to analyse code for security vulnerabilities by simulating the user interactions while the application runs.
● Software Composition Analysis (SCA)
SCA tools identify open-source components with known vulnerabilities and suggest possible remediations.
● Mobile Application Security Testing (MAST)
MAST analyses the behaviour of the applications during runtime to identify actions that an attacker could exploit.
This is a comprehensive review of an organisation's security practices, and efficiency, using a combined approach of security assessment, penetration testing, and risk assessment.
Failure in these discussed principles would compromise sensitive data, credibility and reputation.
Some practical Security Testing tools are:
The OWASP ZAP
Zed Attack Proxy functions as an integrated penetration testing tool. You can use it to test your network for vulnerabilities.
Acunetix by Invicti is a simple tool that identifies a wide variety of online security weaknesses and assists security and development experts in resolving them quickly.
SQLMap is a penetration testing tool that automates detecting and exploiting SQL injection flaws and database takeovers. It utilises five SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query, and stacked queries.
Intruder is a cloud-based vulnerability scanner that uncovers vulnerabilities in cloud servers, websites, endpoint devices, application bugs, injections, cross-site scripting, missing security patches, and encryption weaknesses.
Wireshark is a network analysis tool that reveals minute data about your network protocols, decryption, and packet information.
BeEF (Browser Exploitation Framework)
Browser Exploitation Framework detects an application’s weakness using browser vulnerabilities by using client-side attack vectors to verify the security of an application and can issue browser commands like redirection, changing URLs, and generating dialogue boxes.
W3af is a web application attack and auditing framework. Its three-pronged function systems include discovery, audit, and attack, which interact with each other to uncover vulnerabilities.
Vega is a Java-based security testing tool that identifies vulnerabilities by finding and validating SQL injection, cross-site scripting, and inadvertently disclosing sensitive information. In addition, Vega provides automated scanning for brisk testing and proxy interception.
Nogotofail is a program that tests network traffic security that checks applications for known TLS/SSL vulnerabilities and misconfigurations by checking whether the system is vulnerable to man-in-the-middle (MiTM) attacks.
Snyk implements real-time semantic code analysis to automatically identify vulnerabilities in code, open-source dependencies, containers, and infrastructure as code.
Some suitable examples of security testing would be:
● Inputting malicious code in a login query to attempt exploitation of injection vulnerability
● Sending phishing emails to a company address to determine susceptibility to social engineering attacks
● Using Static code analysis tools to scan for coding and architectural flaws
● Probing access control systems to bypass authorisation and access user privileges
Security testing is an essential form of testing for any software system or application because it ensures the protection of authorised access and confidential data, which in turn protects the organization's functionality, profitability, integrity, and continuity.
For perspective, the United States of America budgeted $2.4 billion for software security in 2022, according to Statista.
Interested in discussing a project?
Utafiti wa usalama ni mchakato wa majaribio ya programu ambayo inachambua mifumo ya usalama wa kompyuta ili kufunua kasoro au udhaifu ambao unaweza kusababisha vitisho vya usalama. Kwa kuongezea, inathibitisha ikiwa utaratibu wa ulinzi wa mfumo hulinda data kwa ufanisi kutoka kwa hacking kama inahitajika. Upimaji wa usalama ni msingi wa Cybersecurity, ambayo inalinda mifumo ya kompyuta kutoka kwa mashambulizi mabaya. Ni aina ya majaribio ya programu, ambayo kama jina linavyodokeza, ni mchakato wa kuchambua programu ili kuamua ufaao kwa matumizi yake yaliyokusudiwa. Functional kupima inazingatia jinsi vizuri programu hufanya shughuli zake, wakati non-functional uchambuzi shughuli nyingine. Utafiti wa kawaida wa majaribio ya usalama ni Utafiti wa Usalama, ambao makala hii inazungumzia kwa kina, ikifunika yafuatayo: Kabla ya kuendelea, tunapaswa kusafisha ukoo wetu na maneno ya kawaida yanayopatikana wakati wa kujadili upimaji wa usalama. Uharibifu ni udhaifu wowote katika mfumo wa IT ambao mshambuliaji anaweza kufanikiwa kuitumia kupata ufikiaji usioidhinishwa. Exploit: exploit ni chombo ambacho mpinzani hutumia kwa faida ya udhaifu. Hii inaweza kuwa code, programu, amri, au katika neno moja, Malware. Kitendo cha kutumia exploits kwa mafanikio pia inajulikana kama utumiaji. Tisho: Tisho linaelezea hali ambapo mpinzani anaanza kutumia. Udhaifu ambao umetumiwa hutambuliwa kama tisho. Mali: Hizi ni vitu vya thamani kwa shirika. Wanaweza kuwa nyaraka nyeti, habari ya mteja, nywila, nk. Hatari: Hatari ni uharibifu wa uwezekano tishio inawakilisha kwa mali ya shirika. Malicious: Hii inafafanua nia ya kusababisha madhara au uharibifu kwa mfumo wa programu au maombi. Programu-jambo: Hii ni programu yoyote ya programu mbaya inayotumiwa na washambuliaji kutumia udhaifu. Mifano ni pamoja na keyloggers, spyware, adware, ransomware, virusi, nk. Open Web Application Security Project (OWASP) ni shirika la kimataifa lisilo la faida linalojumuisha jamii ya mtandaoni ya mashirika, mashirika ya elimu, na watu binafsi waliojitolea kutoa zana za kimataifa, rasilimali, na habari ili kuboresha usalama wa programu. Upimaji wa usalama huiga shambulio la uovu dhidi ya programu au mfumo wa mada ili kufunua na kurekebisha udhaifu. Inahusisha kuchunguza kwa ajili ya udhaifu unaojulikana wa programu na kujaribu kuzitumia. Watengenezaji kisha kutekeleza matokeo ya vipimo hivi ili kurekebisha mapungufu hayo na kuimarisha utaratibu wa usalama. Upimaji wa usalama unaweza kufanyika kwenye programu mpya iliyoundwa kabla ya kupelekwa au kwenye programu iliyopo. Kwa kuongezea, aina fulani za upimaji wa usalama hufanyika hata kabla ya kuendeleza maombi kabisa. Mbinu za kawaida za kupima ni: Upimaji wa usalama wa sanduku jeusi unakusudia kufunua na kutumia udhaifu kutoka nje ya mtandao. Katika kesi hii, mshambuliaji anajaribu hii exploit kipofu, bila habari ya ndani juu ya chanzo code, IP Configurations, na data nyingine muhimu. Ni simulation ya shambulio na hacker random kupata habari nyeti au kupenya mfumo wa usalama. Hapa, hacker ni vifaa na upatikanaji kamili wa maombi, chanzo code, na habari nyingine. Inalenga kuamua na kutumia udhaifu katika mfumo ambao unaweza kutumiwa kutoka ndani na nje. Grey-sanduku usalama kupima inachanganya black-sanduku na nyeupe-sanduku mbinu. Matokeo yake, mshambuliaji ni vifaa na upatikanaji wa sehemu ya mtandao wa ndani ya kazi ya kufunika uwezekano wote wa tishio. "Kulingana na OWASP, ""Injection"" hutokea wakati mshambuliaji anatumia upungufu wa usalama kwa kuingiza nambari yake katika programu, kuiga mtumiaji aliyokusudiwa, na kupata upatikanaji usioidhinishwa wa habari za siri." Mifano ya sindano ni pamoja na SQL sindano, amri sindano, CRLF sindano, na LDAP sindano. Katika uthibitisho uliotekelezwa vibaya na wito wa usimamizi wa kikao, washambuliaji wanaweza kupata urahisi wa kuingia kwenye mfumo chini ya kivuli cha utambulisho halali wa watumiaji. Wakati API inategemea mbinu zisizo salama za uhamisho wa data, washambuliaji wanaweza kuitumia kupata ufikiaji usioidhinishwa wa habari nyeti kama majina ya mtumiaji, nywila, na data ya mteja. Hii hutokea wakati mshambuliaji hutumia nambari au ushirikiano usio salama kupakia maudhui mabaya ya XML. Mifumo ya kudhibiti upatikanaji kusimamia upatikanaji wa habari na utendaji. Hata hivyo, kama uthibitisho wa kutosha na utekelezaji wa vikwazo vya upatikanaji unashindwa, washambuliaji wanaweza kuzunguka idhini ya kuiga watumiaji wenye haki. Makosa katika usanidi wa usalama yanaweza kuwapa washambuliaji upatikanaji rahisi usioidhinishwa wa mfumo na data zake nyeti. Uharibifu huu hutokea wakati programu ya wavuti inaruhusu watumiaji kuingiza nambari ya desturi katika njia ya URL ambayo watumiaji wengine wanaweza kuona. Hii inaruhusu mshambuliaji kuendesha nambari mbaya kwenye kivinjari, kuiba akaunti za mtumiaji na historia ya ufikiaji, kudhibiti kivinjari kwa mbali, au kueneza Trojan na minyoo. Deserializing data kutoka vyanzo untrusted inaweza kusababisha mshambuliaji kutumia data untrusted kudhibiti maombi, kuanzisha kukataa huduma (DoS) mashambulizi, au remotely kutekeleza code au amri ya kuathiri tabia ya mfumo. API nyingi na vipengele vingine vya mtu wa tatu vina udhaifu unaojulikana sana. Matokeo yake, wao ni nyeti kwa unyonyaji wakati wowote. Mazoea duni ya ufuatiliaji, kama vile kurekodi makosa au mashambulizi yasiyofaa, yanaweza kusababisha utumiaji na uvunjaji wa data. Ili kuelewa jinsi ya muhimu ya majaribio ya usalama ni, unahitaji tu kuangalia uwezekano mkubwa wa uharibifu data uvunjaji inaweza kusababisha. Kwa mfano, shambulio la ransomware linaweza kukuzuia kutoka kwenye mfumo wako, ama kwa kudumu au mpaka utalipwa fidia. Kwa kuzingatia takwimu za kila siku za programu hasidi 560,000 zinazogunduliwa, unaweza kuwa na wasiwasi juu ya usalama wa programu yako. Mashambulizi ya kibiashara ni jambo la kawaida sana leo hivi kwamba hakuna mtu aliye salama kutokana na tisho la kutumiwa vibaya. Polisi wa Shanghai walipata uvunjaji mkubwa zaidi wa data katika historia wakati hifadhidata ya raia milioni 500 za China ilipoibiwa. Facebook imepoteza nambari za simu za watumiaji 533 ambazo zimetolewa kwenye jukwaa la watekaji wa mtandao. Microsoft pia ilipoteza rekodi milioni 240 za msaada wa wateja ambao walikuwa wamebaki bila ulinzi wa nenosiri. Hizi zinaonyesha kwamba hata wavulana wakubwa hawawezi kuepukwa na mashambulizi mabaya. Wakati Microsoft, Facebook, na wengineo wanaweza kuweza kuepuka hasara hizi, waanzilishi wengi hawawezi. Hii ni bahati mbaya kwa sababu 43% ya mashambulizi ya uovu yana lengo la biashara ndogo ndogo, ambayo ni 14% tu ya usalama wa programu yao umelindwa kwa ufanisi. Kwa mfano, gharama ya wastani ya shambulio la ransomware ilikuwa $ 1.85 milioni, na gharama ya wastani ya uvunjaji wa data ilikuwa $ 4.217 milioni. Zaidi ya kipengele cha kifedha, upimaji wa usalama pia unatafuta kulinda maadili sita kuu. Usiri: Shirika linapaswa kuweka habari za wateja binafsi na salama. Uadilifu: Uadilifu inahakikisha kwamba rekodi data na faili ni kinga dhidi ya uharibifu, marekebisho, au kufuta. Upatikanaji: Hii ni rahisi, moja kwa moja utoaji wa habari ya mteja mara tu inahitajika. Uhalali: Hii huamua ngazi ya haki za mtumiaji au upatikanaji wa data, faili, au huduma. Uthibitisho: Hii inathibitisha uhalali au utambulisho wa mtu au taasisi inayotaka upatikanaji. Non-repudiation: Hii ni uwezo wa kuthibitisha utambulisho au chanzo cha mtumiaji au mtu binafsi kufanya hatua fulani. Ukosefu wowote katika kutekeleza kanuni hizi unaweza kuwa na madhara ya moja kwa moja kwa shirika na inaweza kusababisha kupoteza habari na mapato, uharibifu wa sifa na kuendelea kwa chapa, pamoja na dhima ya kisheria. Hii inahusisha kutumia zana za skanning kutambua udhaifu, kasoro, au mapungufu katika mifumo ya usalama wa programu. Hii ni mchakato wa kuiga mashambulizi mabaya dhidi ya mfumo wa usalama kufunua udhaifu na kujaribu kuzitumia. Upimaji wa kupenya hufanywa ili kutathmini mifumo ya ulinzi bila kusababisha uharibifu. Hii inaweza kufanywa na watekaji wa kuaminika au wafanyikazi wa kujitegemea ambao hufanya operesheni na kufikia shirika. Utaratibu huu hutambua mali, thamani yao kwa shirika, udhaifu wao, na vitisho kwao. Pia hupima ukubwa wa matokeo ya matumizi yenye mafanikio na gharama ya kurekebisha. Utaratibu huu ni kufanyika kwa probing kwa ajili ya kasoro katika mfumo Configurations. Hizi misconfigurations inaweza kuwindwa chini kwa kutumia zana mwongozo au automatiska. Hii inahusisha kukagua mazoea ya usalama kulingana na viwango vinavyokubaliwa na sekta. Ni kawaida inahusisha ukaguzi wa kanuni, ukaguzi logs, Configurations, na mifumo ya uendeshaji kuthibitisha kama wao kukidhi mahitaji ya kuchapishwa. Hii ni mchakato wa kuchambua mfumo wa usalama wa maombi kufunua kasoro na udhaifu. Inalenga kutambua udhaifu kabla ya kupeleka maombi au haraka iwezekanavyo kurekebisha baada ya uzinduzi. Aina ya majaribio ya programu ya maombi ni: Static Application Security Testing (SAST) SAST hutumiwa kulinda maombi kwa kukagua chanzo code kufunua udhaifu wakati si mbio. Ni mbinu ya kupima sanduku nyeupe. Dynamic Application Testing (DAST) - Inachunguza hatari za usalama kwa kuiga aina tofauti za mashambulizi dhidi ya programu wakati wa kukimbia. Vifaa vya DAST havihitaji upatikanaji wa nambari ya chanzo na kuanguka chini ya upimaji wa sanduku nyeusi. Interactive Application Security Testing (IAST) ni mfumo wa majaribio ya usalama wa programu (SAST) na DAST (DAST) ambayo hutumia teknolojia ya kompyuta kugundua udhaifu wa usalama kwa kuiga mwingiliano wa watumiaji wakati programu inapoendesha. • Programu Composition Uchambuzi (SCA) - SCA zana kutambua sehemu wazi-chanzo na udhaifu unaojulikana na kupendekeza marekebisho ya uwezekano. Mast (Mobile Application Security Testing) ni mfumo wa majaribio ya usalama wa programu ya runtime ambayo hutumia uwezo wa mhasiriwa wa kugundua makosa ya programu. Hii ni ukaguzi wa kina wa mazoea ya usalama wa shirika, na ufanisi, kwa kutumia mbinu ya mchanganyiko wa tathmini ya usalama, upimaji wa kupenya, na tathmini ya hatari. Kushindwa katika kanuni hizi zilizozungumziwa kungehatarisha data nyeti, uaminifu na sifa. OWASP ZAP Zed Attack Proxy ni chombo cha majaribio ya kupenya. Unaweza kuitumia kupima mtandao wako kwa ajili ya udhaifu. Acunetix ni chombo rahisi ambacho hutambua aina mbalimbali za udhaifu wa usalama wa mtandaoni na husaidia wataalamu wa usalama na maendeleo katika kutatua haraka. SQLMap ni chombo cha kupima kupenya ambayo automatizes kugundua na kutumia SQL sindano kasoro na database kuchukua. Ni hutumia tano SQL sindano mbinu: boolean-msingi kipofu, muda-msingi kipofu, makosa-msingi, UNION swali, na stacked maswali. Intruder ni scanner ya udhaifu wa wingu ambayo inagundua udhaifu katika seva za wingu, tovuti, vifaa vya mwisho, makosa ya maombi, sindano, maandishi ya tovuti, patches za usalama zilizopotea, na udhaifu wa encryption. Wireshark ni chombo cha uchambuzi wa mtandao ambayo inaonyesha data dakika kuhusu itifaki yako ya mtandao, decryption, na taarifa ya pakiti. BeEF (Browser Exploitation Framework) ni mfumo wa ujasusi wa ujasusi ambao hutambua udhaifu wa programu kwa kutumia udhaifu wa kivinjari kwa kutumia vector za shambulio la upande wa mteja ili kuthibitisha usalama wa programu na inaweza kutoa amri za kivinjari kama kuelekeza, kubadilisha URL, na kuzalisha masanduku ya mazungumzo. W3F ni mfumo wa ufuatiliaji wa mtandao na mashambulizi ya mtandao. Mifumo yake ya kazi ya pande tatu ni pamoja na ugunduzi, ukaguzi, na shambulio, ambayo huingiliana na kila mmoja kufunua udhaifu. Vega ni Java-msingi usalama kupima chombo kwamba kutambua udhaifu kwa kupata na kuthibitisha SQL sindano, msalaba-sitia scripting, na inadvertently kufichua habari nyeti. Aidha, Vega hutoa automatiska skanning kwa ajili ya upimaji brisk na kuingiliwa proxy. Nogotofail ni programu ya majaribio ya usalama wa trafiki ya mtandao ambayo inachunguza maombi kwa ajili ya TLS na SSL udhaifu unaojulikana na misconfigurations kwa kuangalia kama mfumo ni dhaifu kwa man-katika-kati (MiTM) mashambulizi. Snyk inatekeleza wakati halisi semantic code uchambuzi kwa moja kwa moja kutambua udhaifu katika code, wazi-chanzo utegemezi, vyombo, na miundombinu kama code. • Kuingiza nambari mbaya katika swali la kuingia ili kujaribu kutumia udhaifu wa sindano ya kuingiza, kutuma barua pepe za udanganyifu kwa anwani ya kampuni ili kuamua uwezekano wa mashambulizi ya uhandisi wa kijamii, kutumia zana za uchambuzi wa nambari ya static kuchunguza kwa makosa ya coding na usanifu, na kutumia mifumo ya kudhibiti upatikanaji ili kuepuka idhini na upatikanaji wa haki za watumiaji. Kwa mujibu wa Statista, Marekani imepanga bajeti ya dola bilioni 2.4 kwa ajili ya usalama wa programu mwaka 2022. Je, unavutiwa kuzungumzia mradi fulani?