Have Any Questions?

+1 781-640-0588

Neova Tech Solutions Logo
Neova Tech Solutions Logo

Posted by Navdeep Rathore

browser automation tools protocols
May 19, 2022

Browser Automation Tools Protocols – Webdriver vs CDP 

How do all the popular browser automation tools work under the hood? Can they incorporate missing features in the near future based on their architecture and how their architecture compares to each other test runners? 

The underlying architecture of all the browser automation tools are quite different. To communicate and control the browser and the application under the test, the majority of tools can be categorized into three categories: 

  1. WebDriver protocol 
  2. Chrome DevTools Protocol (CDP)  
  3. Native (JavaScript loaded in the same browser application) 

WebDriver Protocol 

We can categorize the available browser automation tools into two groups, The ones that operate on the Webdriver and the ones that are based on the Chrome DevTools Protocol (CDP). 

Selenium was an independent tool until it merged with a similar tool called WebDriver and hence became Selenium Webdriver. Every supported browser version must provide a driver that Webdriver uses for communication. This makes these frameworks cross-browser compatible. This protocol provides you with better support for running the same tests on different browsers and browser versions. 

Unfortunately, Webdriver based tests have the reputation to be flaky which means that if they run under the same circumstances multiple times, they can either fail or succeed. That shows a bad reputation for a testing framework. You spend a good amount of time building something that should guarantee the stability of the application and then you cannot even trust that. 

Some of the popular tools implementing this protocol are: Selenium Webdriver, WebdriverIO, Nightwatch 

Webdriver Protocol

Chrome DevTools Protocol (CDP) 

The Chrome DevTools Protocol (CDP) uses WebSocket connection to communicate from the test runner to the browser. DevTools are present in all modern browsers. As the name suggests it is a tool for developers which helps to analyze and debug. 

CDP tool is available for Chromium-based browsers (Chrome, Edge, Opera, Brave). You can access this developer tool by using the keyboard shortcut CTRL + SHIFT + I or F12 

Two quite popular tools are Puppeteer and Playwright. They do not depend on the Webdriver but instead talk directly to the browser via the Chrome DevTools Protocol (CDP). This provides them with much better control which leads to more stable tests. 

Some of the popular tools implementing this protocol are: Playwright, Puppeteer. 

Chrome Devtools Protocol

Native (JavaScript loaded in the same browser application) 

The application and the tests share the same process & domain.  

Hence, the test can directly access the  

  • DOM 
  • Application’s objects 
  • Browser APIs.  

By sharing the event loop, the test and the app take turns: When the app is running, the test code is waiting, when the test code is running, the app is paused. This guarantees that the application does not change between the test steps. 

Some of the popular tools implementing this protocol are: Cypress, TestCafe. 

Flakiness vs. Cross-Browser 

From a very high-level point of view, the closer we get to the browser the more stable the tests become but very less support for cross-browser. On the other hand, the more abstraction we have between our tests and the browser, the flakier tests tend to become but will get more support for cross-browser.  

Webdriver Protocol Chrome DevTools Protocol 
Developed by: W3C Developed by: Chrome Developer Tools 
Needs drivers (proxy servers) No need for drivers 
Relatively slow and More Flaky Fast and Less Flaky 
Supports most of the browsers (More cross-browser support) Supports only modern browsers (Less cross-browser support) 
No access to network-related info (does not support API testing) Has access to the network (Supports API testing) 
Tools Implemented: Selenium WebDriver 3, WebdriverIO, Nightwatch Tools Implemented: Playwright, Puppeteer, Selenium Webdriver 4, Cypress v7 
Flakiness vs. Cross-Browser

Future Trends: 

  • Currently, Selenium Webdriver 4 and WebdriverIO are trying to go beyond JSON HTTP protocol to using a bidirectional WebSocket protocol similar to CDP. 
  • The Playwright team is patching Firefox and WebKit (Safari) to allow CDP to work with all major browsers. 
  • Cypress also has CDP support built-in already from v7 onwards. 

In the future, all browsers might support CDP, or the upcoming protocol known as WebDriver BiDi which will bring stability into the WebDriver world. Things are still evolving. 

Considering it all together, this is the current state of the browser automation protocols used for various popular tools available in the market as of now: 

native

Happy Automation Testing! 

May 19, 2022
0
Security
April 30, 2020

How to achieve security using different types of firewalls

The fact that the dynamic rise of the internet has brought the world closer but also at the same time, it has left us with various kinds of security threats. To ensure the confidentiality and integrity of valuable information of a corporate network from outside threats and attacks, we must have some strong mechanism which is why this firewall comes into the picture.

What is a Firewall?

A firewall is a type of cyber-security tool that is used to filter traffic on a network. Firewalls can be used to segregate network nodes from external traffic sources, internal traffic sources, or even specific applications. Firewalls can be software, hardware, or cloud-based, with each type of firewall having its own unique advantages and disadvantages.

The primary goal of a firewall is to block malicious traffic requests and data packets while allowing legitimate traffic through.

It can be compared with a security guard standing at the entrance of a president’s home. He/She keeps an eye on everyone and physically checks every person who wishes to enter the house. It won’t allow a person to enter if anyone is carrying a harmful object like a knife, gun, etc. Likewise, even if the person doesn’t possess any banned object but appears suspicious, the guard can still prevent that person’s entry.

Top 5 types of firewalls

Firewall types can be segregated into several different categories based on their general structure and method of operation. Here are the top 5 types of firewalls:

  1. Packet filtering firewall
  2. Circuit-level gateway
  3. Stateful inspection firewall
  4. Application-level gateway (aka proxy firewall)
  5. Next-generation firewall (NGFW)

Packet-Filtering Firewalls

Packet-filtering firewalls basically are the oldest type of firewall architecture that creates a checkpoint at a traffic router or switch. The firewall performs a simple check of the data packets which are coming through the router, inspecting information such as the destination IP address, packet type, port number without opening up the packet to inspect its contents.

The good thing about these firewalls is that they don’t require exclusive access to large amounts of data. This means they don’t have a huge impact on system performance and are relatively simple. However, they are also relatively easy to bypass compared to firewalls with more robust inspection capabilities.

Circuit-Level Gateways

Another schematic firewall type that is meant to quickly and easily approve or deny traffic without consuming significant computing resources, circuit-level gateways work by verifying the transmission control protocol (TCP) handshake which is designed to make sure that the session the packet is from is legitimate.

While exceedingly resource-efficient, these firewalls do not check the packet itself. By any chance, if a packet held malware, but had the right TCP handshake, it would pass right through. That’s why circuit-level gateways are not enough to protect your business by themselves.

Stateful Inspection Firewalls

Stateful inspection firewalls combine both packet inspection technology and TCP handshake verification to create a level of protection bigger than either of the previous two architectures could provide alone.

However, these firewalls do put more exertion on computing resources which may slow down the transfer of legitimate packets compared to the other solutions.

Proxy Firewalls (Application-Level Gateways/Cloud Firewalls)

Proxy firewalls operate at the application layer to filter incoming traffic between your network and the traffic source—hence, the name “application-level gateway.” These firewalls are delivered via a cloud-based solution or another proxy device. Instead of letting traffic connect directly, the proxy firewall first establishes a connection to the source of the traffic and inspects the incoming data packet.

This security check is similar to the stateful inspection firewall in that it looks at both the packet and at the TCP handshake protocol. Likewise, proxy firewalls may also perform deep-layer packet inspections, checking the actual contents of the information packet to verify that it contains no malware.

Once the security check is complete, and the packet is approved to connect to the destination, the proxy sends it off. This creates an extra layer of separation between the client and the individual devices on your network, obscuring them to create additional anonymity and protection for your network.

If there’s one drawback to proxy firewalls, it’s that they can create a significant slowdown because of the extra steps in the data packet transferal process.

Next-Generation Firewalls

Most recently released firewall products are being touted as “next-generation” architectures. Nonetheless, there is not as much consensus on what makes a firewall truly next-gen.

Few common features of next-generation firewall architectures include deep-packet inspection (checking the actual contents of the data packet), TCP handshake checks, and surface-level packet inspection. Next-generation firewalls may incorporate other technologies as well, such as intrusion prevention systems (IPSs) that work to automatically stop attacks against your network.

Source :https://images.app.goo.gl/4B6ubRUL6qovWrM59

Conclusion:

Choosing the ideal firewall begins with understanding the architecture and functions of the private network being protected but also calls for understanding the different types of firewalls and firewall policies that are most effective for the organization.

Whichever of the types of firewalls you choose, keep in mind that a misconfigured firewall can, in some ways, be worse than no firewall at all because it lends the threatening impression of security while providing little or none.

April 30, 2020
0
acess-control
April 30, 2020

How does access control protect data?

Who should access the company’s data? How to ensure those who attempt access have actually been granted that access? Under which situations to invalidate access to a user with access privileges?

To strongly protect the data, the organization’s access control policy must address these and many other questions.

What is access control?

Access control is a procedure of ensuring that users have the appropriate access to company data or in simple words a selective restriction of access to data.

Authentication is a method used to verify that someone is who they claim to be. Authentication isn’t sufficient by itself to protect data. What is needed is an additional layer, authorization, which verifies whether a user should be allowed to access the data or make the transaction they’re attempting.

Mostly during a data breach, access controls are among the first policies investigated.

If the data could be of any value to someone without the proper authorization to access it, then the organization needs strong access control, especially for businesses with employees who work remotely out of the office and require access to the company data resources and services.

Access control policy: Key considerations

Many of us work in different various environments or say hybrid environments where data moves from on-premises servers or the cloud to offices, homes which can make enforcing access control difficult.

A cultivated access control policy can be adapted dynamically to respond to evolving risk factors.

Based on the risk factor access control rules must be updated, which means that organizations must establish security analytics layers that sit on top of the existing network and security configuration. They need to identify threats in real-time and automate the access control rules correspondingly.

4 Types of access control

Organizations must determine the significant access control model to adopt based on the type and sensitivity of data they’re processing. Legacy access models include discretionary access control (DAC) and mandatory access control (MAC), role-based access control (RBAC) is the most common model today, and the most recent model is known as attribute-based access control (ABAC).

  1. Discretionary access control (DAC)

DAC is a method of assigning access rights based on rules that users specify. Here data owner decides on access. 

  1. Mandatory access control (MAC)

Here people are granted access based on an information clearance. MAC is an approach in which access rights are assigned based on regulations from a central authority.

  1. Role-Based Access Control (RBAC)

RBAC provides access based on a user’s role and implements key security principles, such as the least privilege and separation of privilege. Thus, someone attempting to access information can only access data that are esteemed necessary for their role.

  1. Attribute-Based Access Control (ABAC)

In ABAC, each resource and user is assigned a series of attributes. Here, a comparative assessment of the user’s attributes, including the time of day, position, and location, are used to make a decision on access to a resource.

It’s upto organizations to decide which model is most suitable for them based on data sensitivity and operational requirements for data access.

Access control solutions

A number of technologies can support various access control models. In a few cases, multiple technologies may need to work together to achieve the desired level of access control.

Most data spread across various cloud service providers dictates the need to orchestrate a secure solution. There are various vendors providing privilege access and identity management solutions that can be integrated into a traditional Active Directory. 2-way Multi Factor authentication can be a component to further enhance security.

Why authorization remains a challenge

Authorization can still be challenging to determine and perpetually monitor who gets access to which data resources, how they should be able to access them, and under which conditions they have granted access, for starters.

Access control must be continuously monitored, in terms of compliance with the corporate security policy as well as operationally, to identify any potential security gaps. Organizations need recurring vulnerability scans against any application running access control functions and should collect and monitor logs on each access for violations of the policy.

Conclusion

Access control must be considered as a technology infrastructure that uses the most advanced tools which reflect changes in the work environment such as increased mobility, identifies the devices we use and their inherent risks, and takes into consideration the rapidly increasing movement towards the cloud.

April 30, 2020
0
Devops
April 28, 2020

DevOps strategies to boost your security

DevOps provides an environment with great potential to enhance security. Practices such as collaboration, continuous testing, automation better feedback loops, provides an opportunity to integrate security as a component of the DevOps processes.

Mostly, a wide range of security flaws and risks exist in the cloud environment, containers, and other resources developers rely on when making applications. This includes the third-party code, tools, networks, and other components of the development systems. Without proper tools, control, and protection, these areas can lead to unstable and insecure applications.

Some factors that increase vulnerabilities include:

  • Wrong configurations and weakness in containers
  • Insecure in-house and third-party code, privilege exposures, etc.
  • Security flaws in the scripts or CI/CD tools
  • Malicious insiders
  • Insecure infrastructure and employee behavior.

Many common DevOps practices inherently lend themselves to providing a development and delivery pipeline that can improve your overall security posture.

Three biggest risks to IT security are as follows: 

  • Human error
  • Lack of process
  • External threats 

DevOps can positively impact all three of these major risk factors, without negatively impacting the stability or reliability of the core business network.

Best DevOps practices to boost your security

Here, is a list of the top five DevOps practices and tooling that can help boost overall security when incorporated directly into your end-to-end continuous integration/continuous delivery (CI/CD) pipeline:

  1. Collaboration
  2. Security test automation
  3. Configuration and patch management
  4. Continuous monitoring
  5. Identity management

Collaboration and understanding your security requirements

Many of us are required to adopt a security policy. It may be in the form of a corporate security policy, a customer security policy, or a set of compliance standards (ex. SOX, HIPAA, etc). Even if you are not mandated to use a specific policy or regulating standard, we all still want to ensure we follow the best practices in securing our systems and applications. The key is to identify your sources of security requirements information and, collaborate early so they can be incorporated into the overall solution.

Security test automation

Whether you are building a brand new solution or upgrading an existing solution, there likely are several security considerations to integrate. Due to iterative agile development, handling all security at once in a “big bang” approach likely will result in project delays. To be certain that projects keep moving, a layered approach often can be helpful to ensure you are continuously building additional security layers into your pipeline as you progress from development to a live product. Security test automation can ensure you have quality gates throughout your deployment pipeline giving immediate feedback to stakeholders on a security standpoint and allowing for quick remediation early in the pipeline.

Configuration management

In traditional development, servers/instances are equipped and developers are able to work on the systems. To make sure servers are equipped and managed using consistent, repeatable, and reliable patterns it’s critical to ensure you have a strategy for configuration management. The key is to be certain you can reliably guarantee and manage consistent settings across your environments.

Patch management

Similar to the concerns with configuration management, you need to make sure you have a method to quickly and reliably patch your systems. Missing patches are a common cause of exploited vulnerabilities including malware attacks. Being able to swiftly deliver a patch across a large number of systems can drastically reduce your overall security exposures.

Continuous monitoring

Make certain you have monitoring in place across all environments with transparent feedback is important so it can alert you quickly of potential breaches or security issues. It is important to identify your monitoring needs across the infrastructure and application and then take benefits of some of the tooling that exists to quickly identify, isolate, and remediate potential issues before they become vulnerable. Most of your monitoring strategy also should include the ability to automatically collect and analyze logs. The analysis of running logs can help identify exposures quickly and compliance activities can become extremely expensive if they are not automated early.

Identity management

DevOps strategies allow us to integrate early with security experts which increase the level of security tests and automation to enforce quality gates for security and provide better mechanisms for ongoing security management and compliance activities.

Conclusion

Incorporating security practices into your DevOps processes boosts in creating an effective security layer for the environment and applications. This, in the future, ensures security and compliance in a more proactive and efficient way.

April 28, 2020
0
Microservices
April 27, 2020

Microservices Security | Best practices to follow

Microservices is an architecture in which all the components of the system are put into individual components that can be built, deployed, and scaled individually. Microservices can serve as an elegant way to break the shackles of monolithic architectures when building or deploying applications. Apart from pioneers such as Netflix, which began exploring this territory a few years ago, chances are microservices are something relatively new for your organization. Protection against cyber-attacks illustrates an even bigger unknown for many.

Let me explain to you a simple analogy

You must have seen how bees build their honeycomb by orienting hexagonal wax cells. In the first instance, they start with a small section using various materials and continue to build a large beehive out of it. These cells form a pattern resulting in a strong structure that holds together a particular section of the beehive. Here, each cell is independent of the other but it also corresponds with the other cells. This means that damage to one cell doesn’t damage the other cells so bees can recreate these cells without impacting the complete beehive.

In this above diagram, each hexagonal shape represents an individual service component. Similar to the working of bees, each agile team builds an individual service component with the available frameworks and the hand-pick technology stack. Just as in a beehive, each service component forms a robust microservice architecture to provide better scalability. Besides, issues with each service component can be handled individually by the agile team with minimal or no impact on the entire application.

Why microservices?

IF

  you are developing a large/complex application

AND

  you need to deliver it rapidly, frequently and reliably

  over a long period of time

THEN

  the Microservice Architecture is often a good choice

Microservices Security – Presumably not what you think it is

Microservices and container security are sometimes incorrectly referred to interchangeably, even though they are two different things. This may be due, in part, to how most enterprises run microservices on containers.

The incertitude between containers and microservices might also have a lot to do with how container security protocols can help to protect against potential vulnerabilities of microservices within containers.

It would be easier if there were a simple algorithm on how to secure a microservice. Unfortunately, there is no such thing. However, there are some practices that can be used as a guide on the way to securing microservices.

1. Use TLS protocols for all APIs

Any application consisting of microservices needs an API as a key. If there are many independent API services, this software might require some additional tools to manage those APIs.

So, what you definitely need is access control. That will provide you secure authentication and authorization. There are some frequently used servers that allow administrators and developers to attain tokens for API authentication.

You can also use third-layer-security protocols for all the APIs to make sure that the system is protected from practicable attacks. All APIs that might be exposed must have an HTTPS certificate. One more last but not the least essential element is to encrypt all the communication between client and server with transport layer security (TLS).

2. Profile all your APIs due to their deployment zones

Malicious software, such as bots often aims at exposing the capabilities of the service too many more recipients than required. Technically, only authorized users are supposed to have access to them. To avoid unnecessary exposure, developers can label all the APIs to ensure who should be able to access them.

The API topology goes as follows:

  • Corporate Zone – private traffic.
  • Hybrid Zone – minimal deployments can be recorded at the data center.
  • DMZ – a zone for traffic originating from the Internet.
  • Ethernet – the app is vulnerable to those outside the data center.

There is also a process called network segmentation. This allows developers to perform partition of traffic and illustrate different content to different user segments.

3. Use OpenID or OAuth 2.0

The main task of these tools is to allow the developer to process user tokens. OAuth 2.0 protocol particularly simplifies the process of securing microservices.

It is an authorization framework that allows users to procure admittance to a resource from the resource server. This is done using tokens.

There are 4 different roles that OAuth 2.0 can play in microservices security patterns: resource server, resource owner, authorization server, and client. These tokens are accountable for access to the resource prior to its expiry time.

There are also refresh tokens that are in charge of requesting new access after the original token has expired.

4. Don’t show sensitive data as plain text

Plain text is easy to read, copy, and overwrite by people and machines. While working on securing the personally identifying information you need to make sure that it is not being displayed as a plain text. All the credentials – passwords and usernames should be masked during the storing in logs or records.

However, adding extra encryption above TLS or HTTP won’t add protection for traffic traveling through the wire. It can only help a little bit at the point where TLS terminates, so it can protect sensitive data from accidentally dumping into a request log.

Additional encryption might help you protect data against those attacks that aim at accessing the log data but it will not help with those which try accessing the memory of the application servers or the main data storage.

5. Use Multi-factor Authentication

It is safer to use a multi-factor authentication system when a user comes to the website and you need to authorize that user. Most apps use two-factor authentication, which requires a username and password as well as another form of identity verification.

By using multi-factor authentication (MFA), you offer your users better protection by default as some aspects are harder to steal than others. For example, using biometrics for authentication takes microservice security on a whole new level.

6. Protect Public APIs From Denial-Of-Service-Attacks

It’s not a rare situation for applications to get sabotaged by Denial-Of-Service-Attacks. Deliberately those are attempts of sending an overwhelming number of service messages with the aim of causing website failure. Such attacks can present themselves in many different shapes. They can also target the entire platform and network stack out of which most of the DoS attacks concentrate on volumetric flooding of the network pipe.

There is a way to prevent huge numbers of API requests causing the DoS attack or other problems with API services. You need to set a limit or restriction on how many requests in a given period of time can be sent to each API.

If the number exceeds the limit, you can block the access from a particular API for some reasonable interval, and also make sure to analyze the payload for threats. 

7. Use Encryption Before Persisting The Data

We have already discussed additional encryption of sensitive data instead of showing it as a plain text. Another option that is highly recommended is that you encrypt the user data before persisting it.

You can also adopt some strong cryptographic algorithms such as RSA 2048+ or Blowfish. They make data transmission much safer. Remember to make sure that the algorithms are compliant with industry standards.

Conclusion

Microservices security requires non-trivial or ready-made solutions. We categorized some of the best practices that might help you with the security of your applications.

Nevertheless, remember that when it comes to security, there is always room and demand for innovation. It’s always better to use cutting edge tools and technologies than sticking with old-fashioned approaches and hoping for the best.

April 27, 2020
0
Banner-image-10
April 24, 2020

Is CNSP the future of software development?

Application development methodologies or say SDLC are moving away from the traditional “waterfall” or “V” model towards more agile continuous integration delivery (CI/CD) processes with the end-to-end automation. This new approach brings a multitude of benefits, such as quick release time to market and faster delivery, but it also introduces security challenges since traditional security methodologies weren’t designed to address these modern application workflows. 

As developer teams adopt cloud-native technologies, security teams find themselves scrambling to keep up. Minimal prevention controls, lack of visibility, and tools that lack automation yield incomplete security analytics. All of these things increase the risk of compromise and the likelihood of successful breaches in cloud environments. Meanwhile, the demand for an entirely new approach to security emerges. Enter cloud-native security platforms.

Before we dive into what is a cloud-native security platform CNSP, let’s first understand what “cloud-native” actually means.

What Does ‘Cloud-Native’ Mean?

The term “cloud-native” refers to an approach to building and running applications that takes full advantage of a cloud computing delivery model instead of an on-premises data center. 

This process takes the best of what cloud has to offer

  • Scalability
  • Deployability
  • Manageability
  • Limitless on-demand compute power

and applies these principles to software development, combined with CI/CD automation, to radically increase productivity, business agility, and cost savings.

Cloud-native architectures are made up of cloud services, such as containers, serverless security, platform as a service (PaaS), and microservices. These services are loosely coupled, meaning they are not hardwired to any infrastructure components, allowing developers to make changes frequently without affecting other pieces of the application or other team member’s projects – all across technology boundaries, such as public, private and multi-cloud deployments.

In short, “cloud-native security” refers to a methodology of software development that is essentially designed for cloud delivery and epitomizes all the benefits of the cloud by nature.

The 4C’s of Cloud-Native Security

Let’s start with a diagram that may help you understand how you can think about security in layers.

Note: This layered approach augments the defense-in-depth approach to security, which is widely regarded as a best practice for securing software systems. The 4C’s are Cloud, Clusters, Containers, and Code.

As you can see from the above figure, each one of the 4C’s depend on the security of the squares in which they fit. It is nearly impossible to safeguard against poor security standards in Cloud, Containers, and Code by only addressing security at the code level. However, when these areas are dealt with appropriately, then adding security to your code augments an already strong base.

The Beginnings of Cloud-Native Security

As more organizations have embraced DevOps and developer teams have begun to update their application development pipelines, Security teams quickly realized their tools were ill-suited for the developer-driven, API-centric, infrastructure-agnostic patterns of cloud-native security. As a result, cloud-native security platform products began to hit the market. These products on their own, they could not collect enough information to accurately understand or report on the risks across cloud-native environments. They were each engineered to address one part of the problem or one segment of the software stack. This forced security teams to juggle multiple tools and vendors, which increased cost, complexity, and risk in addition to creating blind spots where the tools overlapped but didn’t integrate.

Enter Cloud-Native Security Platforms

Solving this problem requires a unified platform approach that can envelop the entire CI/CD lifecycle and integrate with the DevOps workflow. Just as cloud-native approaches have fundamentally changed how cloud is used, CNSP is fundamentally restructuring how the cloud is secured.

Cloud-native security platform shares context about infrastructure, PaaS, users, development platforms, data, and application workloads across platform components to enhance security. They also:

  • Provide unified visibility for SecOps and DevOps teams.
  • Dispatch an integrated set of capabilities to respond to threats and protect cloud-native applications.
  • Automate the remediation of misconfigurations and vulnerabilities consistently across the entire build deploy run lifecycle.

Cloud-Native Security Platform Future

In the past, organizations that wanted to embrace new compute options were unendurable by the need to buy more security products to support those options. Stitching together disparate solutions in an attempt to enforce consistent policies across technology boundaries became more of a problem than a solution. 

Cloud-Native security platform, however, provides coverage across the continuum of compute options, multi-cloud, and the application development lifecycle. This allows organizations to choose the right to compute options for any given workload, granting them freedom without worry over how to integrate solutions for security. CNSP epitomizes the benefits of a cloud-native strategy, enabling agility, flexibility, and digital transformation.

April 24, 2020
0
Banner-image-11
April 23, 2020

The role of Identity Access Management(IAM) in Cloud Security

Most of the organizations are advancing towards the cloud-based environment. They are transferring their work either on the private or public cloud platforms through various vendors. But sometimes it is a challenging task for all the companies to keep the data safe and secure in the cloud. In the current scenario, the customer needs to face each program anywhere either on-premises or in the cloud. 

What is Identity Access Management in Cloud Computing

The concept of identity in the cloud can refer to many things, but for the purpose of this discussion, we will focus on two main entities: 

  1. users
  2. cloud resources.

IAM policies are sets of permission policies that can be attached to either users or cloud resources to authorize what they access and what they can do with it.

Roles of Identity Access Management in Cloud Security

IAM is crucial to protecting sensitive enterprise systems, assets, and information from unauthorized access or use. This represents the systematic management of any single identity and provides authentication, authorization, privileges, and roles of the enterprise boundaries. 

The primary goal is to upgrade security and productivity by decreasing the total cost, repetitive tasks, and system downtime. Identity access management in cloud computing covers all types of users who can work with defined devices under unlike circumstances. 

In a cloud system, the storage and processing of data are performed by organizations or with the help of third-party vendors. The service provider has to ensure that data and applications stored in the cloud are protected as well as the infrastructure is an insecure environment. Further, users need to verify that their credentials for authentication are secure.

There are many security issues that compromise data in the process of data access and storage in the cloud environment, especially in the case of data storage with the help of third-party vendors who themselves may be a malicious attacker. Though standards and best practices are available for overcoming such security problems, cloud service providers are reluctant in securing their network with the updated set of security standards.

Identity and access management is one of the best practices to measure cloud services. Presently, Identity and Access Management (IAM) provides effective security for cloud systems. IAM systems perform different operations for providing security in the cloud environment that includes authentication, authorization, and provisioning of storage and verification. IAM system guarantees the security of identities and attributes of cloud users by ensuring that the right persons are allowed in the cloud systems. IAM systems also help to manage access rights by checking if the right person with the right privileges is accessing information that is stored in cloud systems. 

Currently, many organizations use Identity and Access Management systems to provide more security for sensitive information that is stored in the cloud environment.

How Identity Access Management can control Interactions with Data and Systems

IAM can move beyond simply allowing or blocking access to data and systems. 

For example, IAM can:

  • Restrict access to data: Specific roles can access only necessary parts of systems, databases, and information.
  • Only allow view access: Users with such roles can only view data, they cannot add, update, or amend it.
  • Only permit access on certain platforms: Users may have access to operational systems, but not on development, testing, or PROD platforms.
  • Only allow access to create, amend, or delete data, not to transmit it: Some roles may not be able to send or receive data outside the system, meaning it cannot be exposed to other third parties and applications.

Based on a company’s specific requirements, there are many ways to implement IAM policies to define and enforce exactly how individual roles can access systems and data.

Why Identity Access Management is a Vital IT Enablement & Security Layer

IAM offers several advantages over all other traditional products. Below is the list to understand the few benefits of identity management in cloud computing:

  • Enhanced Network Abilities: Identity access management (IAM) makes it simple in sharing the network capabilities with a complete grid of users who were connected with it.
  • Support On-demand improvement: 24*7 hours support and monitoring can be provided based on need.
  • Increase Overall Productivity: Cloud-based services are configured and hosted by service providers. As a result, many organizations can improve their overall productivity instead of worrying about the infrastructure.
  • Centralized Management System: Clients can be able to manage all their services and programs at one place with the cloud-based services. Identity access management can be done with one click on a single dashboard.

Conclusion

IAM in the cloud security controls access to resources within that enterprise system by incorporating user policies and restrictions with the verified identity. This is undoubtedly a great way of controlling information about users on the network. It is possible to identify, manage, and control user identities across the entire system by setting up policies, roles, and access. This is definitely a highly intelligent way of handling the security of the uniqueness of an enterprise.

April 23, 2020
0
Banner-image-13
April 21, 2020

Shift Left Security – An Approach in Application Security

Since the beginning of modern computing, security has largely been separated from software development. The latest vulnerability research confirms that over the past five years, out of all published vulnerabilities, 76% were from applications. Given this radical shift in attacker focus, it’s time to implant security with development. The best approach to get this done is to implement a shift-left security strategy.

“Only 20% of organizations following DevOps practices consistently integrate security into the development process”

Source:HPE /True State of Application Security & DevOps

“Only 15% of organizations can remediate security vulnerabilities or address compliance violations as they arise“

Source: Chef| 2017 Community Survey

What is shift-left security?

Moving security practices left into the software development lifecycle with the goal of shifting from a reactive to a proactive security posture.

In the simple definition, “shift left” security is moving security to the earliest possible point in the development process. Modern CI/CD typically involves an eight-step process as shown in the figure below. Many security teams only become involved in the concluding steps of operations and monitoring. Consider that shift-left security is good for reducing not only security risk but also cost. Addressing security issues in design was six times cheaper than during implementation but the same security issues addressed during testing could be 10 times costlier.

Step 1: Define your shift-left security strategy

The first step of any journey is to define where you plan to go. It is important to define what shift-left means in your organization. This is about painting the most evocative picture possible for your teams so they know what success looks like. Key items to include in this document plan are vision, ownership/responsibility, milestones, and metrics. Expect the strategy document to mature over time and don’t spend too much time trying to perfect it. Iteration over time is essential.

Step 2: Understand where & how software is created in your organization

Perhaps one of the most challenging aspects of shifting security left is first getting a hold on how and where software is created in your organization. Depending on the size of your company, this could run the gamut from straightforward to extremely challenging. This step is critical because the end result is what allows the security team to understand where they can actually move security closer to development. In many instances, development is outsourced to multiple vendors, which will require additional work. Small and medium-sized companies will find this step relatively straightforward but equally rewarding.

The objective of this step is to first look organization-wide and document the overall flow of software in your company. Medium to large organizations will want to start at large-scale level and then drill into individual business units. It is certain that each business unit will have its own software development process and tools. Key items to identify in this process include who is developing code (people), how it flows from the development environment to production (process), and which systems they are using to enable the process (technology). This may also be referred to as the CI/CD toolchain. Undoubtedly, much of your software development is being done in the public cloud.

Step 3: Identify and implement security quality guardrails

Quality assurance and quality control has always been part of the software development lifecycle. However, software quality has not historically included security. Every step of the software development process is an opportunity to give feedback and look for security issues. The most effective security teams start small and automate at every stage of SDLC.

Step 4: Assess and continuously train development teams in secure coding

Developers undoubtedly know how to code, but do they know how to do it securely? Most of the time-shifting security left is to ensure that those who do the majority of your coding create secure code in the first place. This is problematic to do if you have no objective measure of where their skills stand today and no plan to improve them continually over time. Given that in one survey, 19% of developers said they were unfamiliar with the OWASP Top 10, this is an area that should not be overlooked. As per a recent survey published by DevOps service provider GitLab, which found that 70% of programmers are expected to write secure code, but only 25% think their organization’s security practices are “good.” If only 25% of developers feel this way, security teams have a lot of work to do in this area.

What shift-left security looks like

Let’s look at these two scenarios below where we have simplified development into build, deploy, and run phases. 

In Scenario 1, development starts without security. Software quality is only checked during runtime. This frequently results in an uneasy conversation between security and development when vulnerabilities are found.

Scenario 1

In Scenario 2, however, security teams have invested the time to understand the development process in their organization. They have also taken the time to merge security processes and tools in the CI/CD pipeline, resulting in automated security quality guardrails.

Scenario 2

Conclusion

Utilizing these four steps above will put your organization on a solid path towards not only shifting security left but making security equal with development. As your organization moves towards shift left as part of its cloud journey, it’s critical that security controls be automated at every stage of the software development life cycle. Neova Solutions empowers security teams to do exactly that by securing DevOps and your CI/CD pipeline.

April 21, 2020
0
Banner-image-15
April 20, 2020

Cypress.io – The future of test automation tool for both Developers and QA

Introduction:

As the quote says above, There’s a new test automation tool that is gaining popularity, real quick in the open-source community, and everyone’s talking about how Cypress may be an alternative to Selenium

Until now, end-to-end testing wasn’t that easy and user-friendly. It was the part developers hated most.

Not anymore!

Cypress makes setting up, writing, running and debugging tests easy. Cypress gives you the power to code as fast as possible.

Cypress is a next-generation front end testing tool for reliably testing anything built for the modern web which addresses the key pain points developers and QA engineers face when testing modern applications.

Cypress is written in JavaScript and packaged into ‘npm’ and runs on Node.js

What is Cypress?

Cypress.io is a custom implementation for selenium’s webdriver API, no need to install drivers for the specific browsers and their versions.

Rise of the test automation tools in the last 2 years:

Cypress Features:

  • Front-end testing tool
  • Open Source
  • Unit, Integration & end-to-end testing
  • Automatic waits, no need to add sleeps to your test
  • Script written in JavaScript
  • Framework – Mocha
  • Assertion – Chai
  • Architecturally different from Selenium
  • Browsers driver are by default included

Browsers Support:

  • Chrome
  • Chromium
  • Electron {Headless}
  • Firefox
  • Edge

System requirements:

Cypress is a desktop application that is installed on your computer. The desktop application supports these operating systems:

  • macOS 10.9 and above (64-bit only)
  • Linux Ubuntu 12.04 and above, Fedora 21 and Debian 8 (64-bit only)
  • Windows 7 and above

If using npm to install Cypress, we support:

  • Node.js 8 and above

Installation:

Three ways to install Cypress:

  1. Using npm
    1. npm install cypress –save-dev
  2. Using yarn
    1. yarn add cypress –dev
  3. Direct download
    1. https://download.cypress.io/desktop

Launch Browser:

Identify Locators and Write Tests:

Run Tests:

Why to choose Cypress:

  1. Open Source
  2. Automation tool for both Developers and QA
    1. Supports frameworks like Jest, Mocha
  3. Runs very fast
  4. Real time reloads
  5. Automatic waiting, no need to add sleeps
  6. Easy to set up, with just one line command
  7. Easy to Write test, JavaScript testing framework
  8. Easy to debug tests
    1. Travel back in time
  9. Not based on selenium
  10.  Runs directly in the browser
    1. Direct access to Application under test
  11.  No need to add any drivers for the browser and it’s version-specific.
  12.  Screenshots and Videos can be captured automatically
  13.  Easy to set up with CI tools
  14.  Flake resistant
  15.  Parallelization
  16.  Supports reporting like Mochawesome or Slack reporting
  17.  Supports all modern web browsers {angular, react, vue} testing.

I hope this blog helped you in implementing test automation using cypress with mocha framework for unit testing as well as end-to-end testing.

At Neova, we have an expert team of QA automation test engineers who are eager to work on the next big product. Feel free to reach us at sales@neovatechsolutions.com for any queries.

April 20, 2020
0
Design patterns
February 4, 2020

Design Patterns in Test Automation – A Quick Walkthrough

Design patterns are best practices that the programmer can adapt to enhance code reusability in a framework or solve common problems when designing a framework.

Automation testing is a process of testing software quality through scripts. Hence, the test design patterns are similar to software design development. Design patterns show how to design the test automation suite so that it will be efficient and easy to maintain. The most challenging part of creating automation framework has always been the code maintenance. 

A lot of test automation projects have been immersed or were scrapped due to the inability of the frameworks to cope up with the growing codebases or test suite. In order to keep the maintenance cost low, the automation engineers should strive to optimize the code that they reinvent or create from scratch by using best design techniques and code coverage of existing functionality for common, generic, or repeated operations.

The main benefits of leveraging design patterns in test automation is increasing 

  • Stability
  • Maintainability
  • Flexibility
  • Reliability
  • Clarity

All of them are important but different aspects can be reached by using different patterns.

WHAT ARE THE DIFFERENT TYPES OF TEST AUTOMATION FRAMEWORKS?

1. Design Patterns for the Test Implementation

From the test automation methodology perspective, different design patterns can be understood as types of automation frameworks.

S.NoDesign PatternDescription
1Recorded testsThe actions of the user are recorded by the automation tool. To execute the test, this recorded script is played back as it is.
2Modular testsModular tests require the creation of small, independent scripts that represent modules, sections and functionality of the AUT.
3Data-driven automation testsTest input and the expected output results are stored in a separate data file and a single driver script executes all the test cases with multiple sets of data.
4Keyword-driven automation testsThe test implementation is done through data tables and self-explanatory keywords. The keyword-driven testing is an extension to the data-driven testing.
5Hybrid test automationHybrid testing framework is the combination of data-driven and keyword-driven testing frameworks.
6Behaviour-driven testsTests are written in the form of simple text features descriptions in ubiquitous languages with scenarios typically written before anything else checked by the non-technical shareholders.

2. Functional Design Patterns

S. NoDesign Pattern
1Fluent pattern
2Singleton pattern
3Page Factory pattern
4Page Object Model pattern
5Facade pattern

Page Object Pattern

  • Page Object Element Map 
    • Contains properties of all web elements of the page and their locators
  • Page Object
    • Contains actions of the page
  • Page Object Validator
    • Contains validations/assertions on the page
  • Tests Class 
    • Contains a group of tests referencing the page objects, it can hold only a single instance of the page object.

Facade Design Pattern

  • Facade
    • Contains methods that combine actions executed on multiple pages
  • Page Objects (ItemPage)
    • Contains the actions that can be performed on the page like Search and Navigate. Exposes easy access to the Page Validator through the Validate() method. 
  • Page Object Element Map 
    • Contains properties of all web elements of the page and their locators
  • Page Object Validator
    • Contains validations/assertions on the page
  • Tests Class 
    • Contains group of tests referencing the facade, it can hold only a single instance of the facade.

Singleton Design Pattern

  • Page Objects (ItemPage)
    • Contains the actions that can be performed on the page like Search and Navigate. Exposes easy access to the Page Validator through the Validate() method. 
  • Page Object Element Map 
    • Contains properties of all web elements of the page and their locators
  • Base Page
    • Includes an instance to the child page’s validator class through the Validate method.
  • Base Singleton 
    • An abstract class that extends a static property of its child instance.

Fluent Page Object Design Pattern

  • Page Objects (ItemPage)
    • Contains the actions that can be performed on the page like Search and Navigate. Exposes easy access to the Page Validator through the Validate() method. 
  • Base Page
    • Grants access to the child’s page element map class and define a standard navigation operation.
  • Base Singleton 
    • Provides an abstract class that extends a static property of its child instance.
  • Base Page Validator
    • Provides child validators instance to the current element map and the page object itself.

What are the advantages of using Design Patterns?

The use of design patterns offers below advantages:

  • Low maintenance effort and time
  • Low maintenance cost
  • Enhanced code reusability
  • Enhanced reliability
  • Structured codebase which is easy to fix and extend
  • Improved communication

Conclusion

The test automation design patterns contribute to a major part in defining the test automation best practices. The benefits of test automation cannot be acquired effectively without implementing the required test design patterns specific to an automation framework project.

February 4, 2020
0

Headquarters

4701 Patrick Henry Drive, Bldg.16, Suite 106, Santa Clara, California 95054

+1 781-640-0588sales@neovatechsolutions.com

Development Center

P3-603, Pentagon Tower, Magarpatta City, Hadapsar, Pune, MH 411028

+91 960-702-3233jobs@neovasolutions.com

COPYRIGHT 2022 © NEOVA TECH SOLUTIONS INC.

Privacy Policy