Security validation of software delivered as a service
An electronic computing device obtains application source code to be tested. The application source code is automatically categorized into one or more hardware or software classifications. One or more tests are identified for the application source code based on the one or more hardware or software classifications. The one or more tests are run against the application source code. The one more tests are monitored as they are running Based on results from the one or more tests, a test score representing a security risk of the application source code is automatically determined. A summary of the results from the one or more tests, including the test score, is visually displayed on the electronic computing device.
1. A method for testing a software application on an electronic computing device, the method comprising:
storing versioning information for the software application on the electronic computing device;
periodically checking a current version of the software application on the electronic computing device for changes;
when the current version of the software application changes, automatically triggering execution of a security test against the software application;
monitoring the security test;
when the software application fails the security test, flagging the software application as vulnerable;
applying one or more test strings to the software application;
sending data between the electronic computing device, using the software application, and one or more additional electronic computing devices, the data including at least one of the one or more test strings;
monitoring network traffic between the electronic computing device and the one or more additional electronic computing devices;
determining a size of the data being transmitted between the electronic computing device and the one or more electronic computing devices;
using time stamps associated with transmission of the data and the size of the data to determine a level of the network traffic; and
when the level of the network traffic is greater than expected, flagging the software application as vulnerable.
2. The method of claim 1 , further comprising:
implementing the software application in client computer software that runs a web browser; and
applying the one or more test strings to the client computer software.
3. The method of claim 2 , further comprising applying the one or more of the test strings to an applet that runs in the web browser.
4. The method of claim 1 , further comprising:
implementing the one or more test strings in a custom script;
implementing the software application on the electronic computing device; and
monitoring a performance of the electronic computing device running the custom script.
5. The method of claim 1 , further comprising detecting whether the software application is vulnerable to one or more of injection errors or replay attacks.
6. An electronic computing device, comprising:
a processing unit; and
system memory, the system memory including instructions which, when executed by the processing unit, cause the electronic computing device to:
store versioning information for the software application on the electronic computing device;
periodically check a current version of the software application on the electronic computing device changes;
when the current version of the software application changes, automatically trigger execution of a security test against the software applications;
monitor the security test;
when the software application fails the security test, flag the software application as vulnerable;
apply one or more test strings to the software application;
send data between the electronic computing device, using the software application, and one or more additional electronic computing devices, the data including at least one of the one or more test strings;
monitor network traffic between the electronic computing device and the one or more additional electronic computing devices;
determine a size of the data being transmitted between the electronic computing device and the one or more electronic computing devices;
use time stamps associated with transmission of the data and the size of the data to determine a level of the network traffic; and
when the level of the network traffic is greater than expected, flag the software application as vulnerable.
7. The electronic computing device of claim 6 , further comprising instructions which, when executed by the processing unit, cause the electronic computing device to:
implement the software application in client computer software that runs a web browser; and
apply the one or more test strings to the client computer software.
8. The electronic computing device of claim 7 , further comprising instructions which, when executed by the processing unit, cause the electronic computing device to apply the one or more of the test strings to an applet that runs in the web browser.
9. The electronic computing device of claim 6 , further comprising instructions which, when executed by the processing unit, cause the electronic computing device to:
implement the one or more test strings in a custom script;
implement the software application on the electronic computing device; and
monitor a performance of the electronic computing device running the custom script.
10. The electronic computing device of claim 6 , further comprising instructions which, when executed by the processing unit, cause the electronic computing device to detect whether the software application is vulnerable to one or more of injection errors or replay attacks.