Thursday, October 8, 2015

Why is Root Cause Analysis Extremely Important?

When developing a product, while it is extremely difficult to maintain quality of the product due to its complexity and shorter time to market, it is also important to keep the cost low to stay competitive.It becomes essential for the software developers to consider variousaspects while developing any product. Though, all the guidelines are abided, problems still arise in the software in form of defects. There are several factors for the defect to arise and product to fail such as, human factor, communication failure, poor design logic, unrealistic development timeframe, lack of skilled testing, poor coding practices etc.  Besides this, the difficulty intensifies if the same defects recur during the development cycle of the products either new or enhanced versions. The solution lies in conducting the root cause analysis of the defects and then taking corrective actions so that they don’t recur.

What is Root Cause Analysis?

At the very basic level, root cause analysis is a methodology used to find the underlying cause of the defect. As it signifies to product development, Root cause analysis is a systematic procedure for putting the defects in categories and analysing them before release, after the release or both. WhenRCAis performed properly, it shows the points in the development cycle that are causing the main and recurring defects. Root Cause Corrective Action (RCCA) is when corrective actions are applied to solve the problems that occur during RCA. The corrective actions are carried out far upstream in the procedure as possible, as catching failures upstream prevents rework, saves time and money by not letting the problem to take place.

How Root Cause analysis helps reduce recurring defects?

Firstly, the defects are logged and documented. Secondly, the defects are reviewed and analysed using the root cause analysis techniques. But before Root Cause analysis is performed, a Pareto graph is outlined to show the defect type with highest frequency of occurrence which becomes the target. An example of defect classification in a Pareto graph is shown below:




According to the Pareto graph, the category for which the highest numbers of defects are found should be paid attention to at first.

The Root Cause Analysis of a defect follows the below key principles:
  • Minimizing the defects to improve quality: the analysis must lead to making changes in processes which help prevention of defects in the early stages and ensure early detection.
  • Utilizing local and third party expertise: the people who really know what went wrong should be there to analyse processes along with third party experts. A good debate ensures all possibilities are taken care of, analysed and the best possible action is taken.
With these guidelines, defects are analysed to find their origins. A collection of these causes will help in conducting the root cause analysis in effective manner.


Why Root Cause Analysis is extremely important?

 
The main benefit of RCA is that it finds the fundamental errors in the development process, enabling teams to enact right measures to fix the problems and stop them from recurring ahead. Hence, there is lesser rework and fewer defects in the final product.
  1. Reduced cost: the cost of fixing defects increases later the defects are found in the development process and if a defect makes it into the final release, customers may never buy the product again, resulting in loss of revenue to the firm.
  2. Identify failure: It points RCA is mainly helpful for teams that think they have apt development and QA procedures but still face recurring defects. Obviously, something is broken but what, why and where are the questions that need to be answered. RCA helps answer these questions and find the real (root) cause of the problem and not just the obvious (direct) cause.
  3. Improve safety and reliability: As root cause analysis helps reducing the number of defects in future, it can be mainly beneficial to firms in quality critical industries where product reliability and safety are mainly important.
  4. Enhance time to market:  On finding the root cause of a defect and taking the subsequent corrective action, releases of the product take less time in testing and the product is released in the market sooner with lesser uncaught defects.
The benefits of adopting the Root Cause Analysis process to prevent defects are enormous viz. reduces development time and cost, increases customer satisfaction, reduces rework effort thereby decreases cost and improves the quality of the product.

Monday, September 28, 2015

What Are Mobile Security Threats? Tips for testing your mobile app security

 
 

Mobile Security Threats – Overview - Part 1

The movement of critical applications to mobile is faster than expected. “eMarketer” expects mobile to overtake desktop in US- rising from $8.72 billion to $12.85 billion — just slightly above desktop’s $12.82 billion. At the same time, there will be 156.4 million mobile phone search users in the US, representing 49.0% of the population. As of Feb 2015, 78% of Facebook users are mobile-only. 84% of 13-17 year old own a mobile phone. 83% of 6-9 year old use a tablet.Mobile device makers are providing customized platforms to increase their share of the customer’s wallet.78% of smartphone users access a retail site via a mobile app. These people want on-the-go, targeted information with minimal data use that a mobile app provides. 44% of tablet users accessed a retail site via a mobile app.
 

 

Mobile Applications

There are three types of applications which are hosted in any Mobile. Native applications written in a specific platform will run only in the supported devices like iOS for iPhone. Most common are the Web applications which any mobile device can access that are built using standards like HTML5 and available online. The last one is the Hybrid applications, a web-based user interface that have a layer of native applications around it which combines the best of both i.e. native and HTML5 worlds.

Mobile Security

Mobile Security – Five vulnerable areas

As the horizon widens, the scope for security threat also increases substantially for the mobile applications. The security risk for mobile applications comes in the following five ways.
  1. How the access to the system works? Where the users are challenged while accessing the systems? How passwords and userids can be tracked in mobiles?
  2. How the data which comes to the Mobile applications is validated?
  3. How to track the audit trail of data flow – to and from Mobile applications?
  4. How safe is the data stored in the Mobile devices? Does encryption happens for all critical data?
  5. Is data leaking to log files or out through notifications?

Five Major Mobile Security Threats:

The following are the 5 major threat areas which impacts the mobile security.
  • Firstly, the data available in the mobiles like phone numbers, call logs, contacts, account details, IMEI can be accessed without the knowledge of the mobile owners which may be due to vulnerabilities in the applications installed in Mobiles.
  • Second, major one which may cause financial losses are like sending premium SMS messages, stealing PIN numbers from transaction authorizations, making expensive calls, Fake anti-virus and ransomware.
  • Thirdly, impersonation can happen by SMS redirection, sending email messages and posting in social media like Face book, Twitter etc.
  • Fourthly, there may be surveillance issues like accessing the audio, camera, call logs, locations and SMS message in the mobile devices.
  • Lastly, Botnet activities like launching DDoS activities, Click fraud, and sending premium SMS messages from the device.

Mobile Security Threat Modelling:

Before proceeding on the vulnerabilities existing in the mobile apps and threat modelling, we should categorize the applications available in the Mobile, the type of applications ported in the device by the manufactures. Normally developers of these applications should have considered the OWASP top 10 threats and addressed the same. For example, in a SQL injection, the code should verify that use of interpreters clearly separates untrusted data from command or query.
Before identifying the threats, the factors which expose the mobile applications like – location independence, always online and traceable nature, more focus on design and functionality than security, multiple types of applications on devices, should be considered and appropriate weight should be given.
The threat modeling should consider both the device security and app security – jail break, different platforms, versions, interfaces, Mobile Device Management etc., Also, the exposure to different attackers like internal, external, network or device access, black box/white box should be considered.
Having identified the threats, risk should be attached to each of the identified risks and risk prioritization should be done. The test cases should be written for all possible combinations for these identified risks.

Mobile Security Tools/Testing Tools:

There are many commercial tools available which protects your mobiles against anti-theft, antivirus, back-up essentials, blocking unwanted calls, parental controls, web-root analyses, SIM card locking. These tools are available to the end-users to protect their devices.
Still the mobile security testing tools area is emerging with tools which can comprehensively address the above mobile security threats. The tools which identify the vulnerabilities in the applications are quite good. The mobile security tester should find the appropriate tools to identify the vulnerability and write comprehensive test cases to address them in the mobile devices and applications.

It's Your Turn:

What do you Think? How to protect your mobile device with 360 degree Security, Share your insights in the comments box below. The next part of the content is coming next.  ~~ Keep Following ~
Menu :