|
|
1. PERFORMANCE
1.1 LOAD
1.1.1 Many users
requesting a certain
page at the same time or
using the site
simultaneously
1.1.2 Increase the
number of users and keep
the data constant
1.1.3 Does the home page
load quickly? within 8
seconds
1.1.4 Is load time
appropriate to content,
even on a slow dial-in
connection?
1.1.5 Can the site
sustain long periods of
usage by multiple users?
|
1.1.6 Can the site
sustain long periods of
continuous usage by 1
user?
1.1.7 Is page loading
performance acceptable
over modems of different
speeds?
1.1.8 Does the system
meet its goals for
response time,
throughput, and
availability?
1.1.9 Have you defined
standards for response
time (i.e. all screens
should paint within 10
seconds)?
1.1.10 Does the system
operate in the same way
across different
computer and network
configurations,
platforms and
environments, with
different mixes of other
applications?
1.2 VOLUME
1.2.1 Increase the
data by having constant
users
1.2.2 Will the site
allow for large orders
without locking out
inventory if the
transaction is invalid?
1.2.3 Can the site
sustain large
transactions without
crashing?
1.3 STRESS
1.3.1 Increase both
number of users and the
data
1.3.2 Performance of
memory, CPU, file
handling etc.
1.3.3 Error in software,
hardware, memory errors
(leakage, overwrite or
pointers)
1.3.4 Is the application
or certain features
going to be used only
during certain periods
of time or will it be
used continuously 24
hours a day 7 days a
week? Test that the
application is able to
perform during those
conditions. Will
downtime be allowed or
is that out of the
question?
1.3.5 Verify that the
application is able to
meet the requirements
and does not run out of
memory or disk space.
1.4 SECURITY
1.4.1 Is
confidentiality/user
privacy protected?
1.4.2 Does the site
prompt for user name and
password?
1.4.3 Are there Digital
Certificates, both at
server and client?
1.4.4 Have you verified
where encryption begins
and ends?
1.4.5 Are concurrent
log-ons permitted?
1.4.6 Does the
application include
time-outs due to
inactivity?
1.4.7 Is bookmarking
disabled on secure
pages?
1.4.8 Does the key/lock
display on status bar
for insecure/secure
pages?
1.4.9 Is Right Click,
View, Source disabled?
1.4.10 Are you prevented
from doing direct
searches by editing
content in the URL?
1.4.11 If using Digital
Certificates, test the
browser Cache by
enrolling for the
Certificate and
completing all of the
required security
information. After
completing the
application and
installation of the
certificate, try using
the <-- BackSpace key to
see if that security
information is still
residing in Cache. If it
is, then any user could
walk up to the PC and
access highly sensitive
Digital Certificate
security information.
1.4.12 Is there an
alternative way to
access secure pages for
browsers under version
3.0, since SSL is not
compatible with those
browsers?
1.4.13 Do your users
know when they are
entering or leaving
secure portions of your
site?
1.4.14 Does your server
lock out an individual
who has tried to access
your site multiple times
with invalid
login/password
information?
1.4.15 Test both valid
and invalid login names
and passwords. Are they
case sensitive? Is there
a limit to how many
tries that are allowed?
Can it be bypassed by
typing the URL to a page
inside directly in the
browser?
1.4.16 What happens
whentime out is
exceeded? Are users
still able to navigate
through the site?
1.4.17 Relevant
information is written
to the logfiles and that
the information is
traceable.
1.4.18 In SSL verify
that the encryption is
done correctly and check
the integrity of the
information.
1.4.19 Scripting on the
server is not possible
to plan or edit scripts
without authorisation.
1.4.20 Have you tested
the impact of Secure
Proxy Server?
1.4.21 Test should be
done to ensure that the
Load Balancing Server is
taking the session
information of Server A
and pooling it to Server
B when A goes down.
1.4.22 Have you verified
the use of 128-bit
Encryption?
|
